Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

youradexchange


  • This topic is locked This topic is locked
5 replies to this topic

#1 MikeJackson

MikeJackson

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 08 April 2015 - 11:12 AM

My computer is infected with this so I keep being redirected to  youradexchange.com when I click on a page.  I don't have to click on a link, anywhere will do and a new tab opens.

I have tried Malwarebytes, Norton 360, spybot  S&D and AdWCleaner. None of them find anything so any help would be appreciated.

Addition.txt is attached.

 

FRST.txt is too large to upload

Thanks in advance

 

MikeAttached File  Addition.txt   55KB   2 downloads



BC AdBot (Login to Remove)

 


m

#2 MikeJackson

MikeJackson
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 08 April 2015 - 11:14 AM

I have added FRST.txt as a zip file

Attached Files

  • Attached File  FRST.zip   58.92KB   1 downloads


#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,264 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:47 PM

Posted 09 April 2015 - 08:57 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.


start

CloseProcesses:

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
CHR Extension: (QuickTime for Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\glkdifongmamddfegpjkmghbmoikkjai [2015-04-05]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.google.com/service/update2/crx
AlternateDataStreams: C:\ProgramData\sdpsenv.dat:naughtypirates
AlternateDataStreams: C:\ProgramData\Temp:5BB2E82D
AlternateDataStreams: C:\ProgramData\Temp:890CC2F3
AlternateDataStreams: C:\Users\User\OneDrive:ms-properties

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

How is the computer running now?

#4 MikeJackson

MikeJackson
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 09 April 2015 - 11:46 AM

Great,  thanks Nasdaq that appears to have solved the problem  :thumbup2: 

 

Attached File  Fixlog.txt   1.91KB   1 downloads

 



#5 nasdaq

nasdaq

  • Malware Response Team
  • 38,264 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:47 PM

Posted 10 April 2015 - 06:48 AM

Glad we could help.

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,264 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:07:47 PM

Posted 15 April 2015 - 08:45 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users