Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple ITD's (Internet Transmited Diseases) at once.


  • Please log in to reply
12 replies to this topic

#1 tlbart1776

tlbart1776

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 21 December 2014 - 04:07 PM

This is my first ever post here and I am really in need of help.  I am not sure what I need to post for logs or exactly where to find them.  I know enough about Win 7 to be dangerous but I don't have the $158 that the local shop wants
 
The problems I am experiencing are many and greatly varied.
 
I am running Win 7 64 bit on an older "lunchbox style" Dell OptiPlex 755.  I have Symantec End Point Protection for A/V.  I have run Malwarebytes with nothing found.  I ran Spybot S & D yesterday (found 5) and 12 days ago it found over 100.  On Dec 1, 2014, while I was away from my desk, Symantec stopped and quarantined 29 attempts for Trojan.Swifi to load onto my computer in 14 1/2 minutes or once every 30 seconds.  I keep getting a message that Symantec blocked pixel.mathtag from loading js.js and if I want to allow it.  Also another one that I can't remember.
 
I will get sounds from video adverts kicking in and out, and multiple videos on a web page starting without me doing a thing.  I have constant adds popping up when I visit a web page.  At times when I want to leave a web page I get pop ups asking if I want to stay or leave.  If I click leave, it will just pop right back up 3-4 times before I can leave the page.
 
I have tried to download Autoruns for Windows and I get a message of "Your current security settings do not allow this file to be downloaded."  I have never had this happen before.
 
I could go on and on.  I started an AutoCADD class and I downloaded the installer on Sept 25, 2014 which is Akamai and that is when things started really going south.
 

Forgot to add, yesterday I had 90 processes running when the computer screwed up, normally there would be about 58, there were a lot of iexplore.exe*32 going and eating up 100% of the CPU.  I unplugged the internet and slowly the numbers declined.  The only way I could get the computer to shut down was to hold the on/off button for 6+ seconds.

 

Thank you in advance.
 
Terry


Edited by tlbart1776, 21 December 2014 - 04:17 PM.
moved from Windows 7 to the appropriate forum


BC AdBot (Login to Remove)

 


m

#2 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:42 PM

Posted 21 December 2014 - 05:06 PM

Download and Install Rkill. Run a scan. DO NOT reboot after completing the scan. Proceed to run the Eset scan for poweliks.

RKill Download

 

 

Please download Powelikscleaner (by ESET) and save it to your Desktop. (let me know if poweliks was found and removed as shown in the last image)
1.  Double-click on ESETPoweliksCleaner.exe to start the tool.
2.  Read the terms of the End-user license agreement and click Agree.
3.  The tool will run automatically. If the cleaner finds a Poweliks infection, press the Y key on your keyboard to remove it.
 
newtool1_zpsa1caa06e.png
 
4.  If Poweliks was detected "Win32/Poweliks was successfully removed from your system" will be displayed. Press any key to exit the tool and reboot your PC.
 
newtool2_zps0e6d39b1.png
 
 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

Check for adware and malware using the programs below. Allow them to remove whatever they find.

 

  • download AdwCleaner by Xplode and save to your Desktop.
  • Double-click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

 

Hold down Control and click on this link to open ESET OnlineScan in a new window.

  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
  • Scan potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

 


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#3 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 21 December 2014 - 05:19 PM

Thanks Buddy for the reply.

 

I tried to download the programs and I keep getting that Security Alert stating "Your current security settings do not allow this file to be downloaded." 

 

Let me do some checking on the settings, but I don't recall changing anything.

 

Terry



#4 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 21 December 2014 - 05:31 PM

I checked the settings under internet properties and both of the security and privacy setting are at default.  I will probably have to download from a friends computer unless you have any suggestions?

 

Terry



#5 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 21 December 2014 - 05:44 PM

I just opened up a new tab and my most used website is https _syndication_twitter_com/i/jot.  Crazy thing is I do not have a twitter account nor have I ever visited there.  The underscores are so the link is not active.

 

I have ghosts in the machine.

 

Terry



#6 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:42 PM

Posted 21 December 2014 - 05:56 PM

Downloading the programs to flash drive or CD then transferring to infected computer will usually work.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#7 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 21 December 2014 - 07:19 PM

Hey Buddy,

 

I just remembered that I had to remove Windows Command Processor virus shortly after I downloaded the AutoCADD installer.  I was getting a popup message every 15-20 seconds.  I used SpyBot S&D to remove it and things worked OK for a while.  This would in late Oct. or early Nov. and may not have got it all.

 

Terry


Edited by tlbart1776, 22 December 2014 - 10:09 AM.


#8 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 22 December 2014 - 10:09 AM

OK, have all 6 downloaded on flash drive.  Heading home to see what happens.

 

I tried the computer this morning, 100 processes running in task manager so I unplugged the router and it settled down to 56 processes.  There were many that ended with .exe*32 and 13 scvhost.exe

 

Terry



#9 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 22 December 2014 - 04:29 PM

OK buddy,

 

I have run all 6 programs and have attached the log files for all but one and that is the ESET online.  I messed up and clicked finish to soon but I can tell you it took 4 hrs and 11 minutes to run that one and it found 3 items.  2 in java and a toolbar that I did not know I had saved somewhere.

 

I am getting an error message of "content too long" for the results.

 

Terry


Edited by tlbart1776, 22 December 2014 - 04:43 PM.


#10 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 22 December 2014 - 04:45 PM

Let me try this way.  The long one by its self.

 

 

 

Rkill 2.6.9 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/22/2014 10:02:11 AM in x64 mode.
Windows Version: Windows 7 Ultimate Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\Users\Terry\AppData\Local\Apps\2.0\O0HGNVQY.MXN\8O204ABN.B6W\dell..tion_0f612f649c4a10af_0005.000a_17ece8424e43daec\DellSystemDetect.exe (PID: 3512) [UP-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * Windows Defender Disabled

   [HKLM\SOFTWARE\Microsoft\Windows Defender]
   "DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

 * Windows Defender (WinDefend) is not Running.
   Startup Type set to: Disabled

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * No issues found.

Program finished at: 12/22/2014 10:04:38 AM
Execution time: 0 hours(s), 2 minute(s), and 26 seconds(s)

 

 

 

# AdwCleaner v4.106 - Report created 22/12/2014 at 10:32:04
# Updated 21/12/2014 by Xplode
# Database : 2014-12-21.4 [Live]
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Terry - TERRY-PC
# Running from : C:\Users\Terry\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

*************************

AdwCleaner[R0].txt - [565 octets] - [22/12/2014 10:32:04]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [624 octets] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Ultimate x64
Ran by Terry on Mon 12/22/2014 at 10:45:39.11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

 

~~~ Registry Keys

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\Terry\AppData\Roaming\pcdr"
Successfully deleted: [Folder] "C:\Users\Terry\appdata\locallow\pcdr"

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 12/22/2014 at 10:49:41.60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



#11 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 22 December 2014 - 04:50 PM

Won't let me do it still too long, Any suggestions?



#12 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:10:42 PM

Posted 22 December 2014 - 06:02 PM

You need to start a new Topic here: Virus, Trojan, Spyware, and Malware Removal Logs Forum - BleepingComputer.com

 

You will need to create a DDS log to post in that forum by following Instruction # 6 here:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help - Virus, Trojan, Spyware, and Malware Removal Logs

 

Once you have created the DDS log and posted it along with a description of the problem, DO NOT bump

your new Topic. Wait for a response. It could be a few days especially with the holidays.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#13 tlbart1776

tlbart1776
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:10:42 PM

Posted 22 December 2014 - 06:49 PM

Bummer, still can't download on this computer though it is running better.  I will have to find a different one tomorrow.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users