Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

gamezonenews.net popup


  • Please log in to reply
5 replies to this topic

#1 Zalera

Zalera

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 08 December 2015 - 01:47 PM

Hi guys, I'm having a problem at the moment where I am getting a russian website page open every night on my web browser. I'm currently using chrome so it will randomly open a tab up once a night to a website called gamezonenews.net. I've tried all kinds of malware removal software and registry cleaners such as ccleaner and have had no success in even finding the file, let alone removing it.

 

I'm at a bit of a loss at the moment, so does anyone have any advice for me?

 

Thanks


Edited by hamluis, 08 December 2015 - 02:04 PM.
Moved from MRL to AII - Hamluis.


BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,196 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:16 AM

Posted 08 December 2015 - 02:18 PM

Welcome to BC !

 

What programs have you used? If none of the below, run a scan using each of them...but tell me which programs you used.

 

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).

  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • When MBAM is finished scanning it will display a screen that displays any malware that it has detected.
  • Click the Remove Selected button.
  • MBAM will now delete all of the files and registry keys and add them to the programs quarantine. When removing the files, MBAM may require a reboot in order to remove some of them. If it displays a message stating that it needs to reboot, please allow it to do so.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.

POST THE LOG FOR  REVIEW.

 

Download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 Zalera

Zalera
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 08 December 2015 - 05:42 PM

Hi there, thanks for the reply

 

I've finished scans on all software applications and my results are attached - 

 

Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 08-Dec-15
Scan Time: 8:47 PM
Logfile: scan.txt
Administrator: Yes
 
Version: 2.2.0.1024
Malware Database: v2015.12.08.04
Rootkit Database: v2015.12.07.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 10
CPU: x64
File System: NTFS
User: Dave
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 333445
Time Elapsed: 11 min, 58 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 10 Pro x64 
Ran by Dave (Administrator) on 08-Dec-15 at 21:03:28.68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 0 
 
 
 
 
Registry: 0 
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08-Dec-15 at 21:05:47.27
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
Adwcleaner also came back with 0 results.
I am currently waiting on the results from ESET but I imagine if the other 3 have come back negative then this one probably will too


#4 buddy215

buddy215

  • Moderator
  • 13,196 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:16 AM

Posted 08 December 2015 - 06:02 PM

After the Eset Scan finishes, you can reset Chrome and post the info from CCleaner.

 

Google Chrome gives you the option to reset your browser settings in one easy click. In some cases, programs that you install can change your Chrome settings without your knowledge. You may see additional extensions and toolbars or a different search engine. Resetting your browser settings will reset the unwanted changes caused by installing other programs. However, your saved bookmarks and passwords will not be cleared or changed.

Reset your Chrome browser settings
  1. In the top-right corner of the browser window, click the Chrome menu
  2. Select Settings.
  3. At the bottom, click Show advanced settings.
  4. Under the section "Reset settings,” click Reset settings.
  5. In the dialog that appears, click Reset.

 

Post the three lists mentioned below using CCleaner.

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

 

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#5 Zalera

Zalera
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 09 December 2015 - 01:29 PM

Hi again, here are the logs you asked for

 

startup

No HKCU:Run AlcoholAutomount Alcohol Soft Development Team "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
Yes HKCU:Run Steam Valve Corporation "C:\Program Files (x86)\Steam\steam.exe" -silent
No HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
Yes HKLM:Run NvBackend NVIDIA Corporation "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
No HKLM:Run RTHDVCPL Realtek Semiconductor "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
Yes HKLM:Run ShadowPlay Microsoft Corporation "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
Yes HKLM:Run Sound Blaster Tactic3D Control Panel Creative Technology Ltd "C:\Program Files (x86)\Creative\Sound Blaster Tactic(3D)\Sound Blaster Tactic(3D) Control Panel\Tactic3D.exe" /r
 
scheduled
Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
No Task Core Temp Autostart Dave "C:\Program Files\Core Temp\Core Temp.exe"
Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
 
installed
3D Builder Microsoft Corporation 16-Sep-15 10.9.6.0
Airytec Switch Off Airytec 20-Aug-15 3.5.1
Alarms & Clock Microsoft Corporation 19-Nov-15 10.1511.61020.0
Alien: Isolation Creative Assembly 25-Sep-15
Any Video Converter Ultimate 5.8.0 Any-Video-Converter.com 13-Oct-15 123 MB
App connector Microsoft Corporation 19-Aug-15 1.3.3.0
Apple Application Support (32-bit) Apple Inc. 20-Sep-15 115 MB 4.0.2
Apple Application Support (64-bit) Apple Inc. 20-Sep-15 123 MB 4.0.2
Apple Mobile Device Support Apple Inc. 20-Sep-15 28.0 MB 9.0.0.26
Apple Software Update Apple Inc. 20-Sep-15 2.40 MB 2.1.4.131
ASUS GPU TweakII ASUSTek COMPUTER INC. 19-Aug-15 62.1 MB 1.0.6.9
Bard to the Future Battlebard Games 20-Sep-15
Batman™: Arkham Knight Rocksteady Studios 20-Aug-15
BioShock Infinite Irrational Games 29-Aug-15
Bonjour Apple Inc. 20-Sep-15 2.01 MB 3.1.0.1
Borderlands 2 Gearbox Software 19-Aug-15
Botanicula Amanita Design 22-Aug-15
Broforce Free Lives 20-Aug-15
Calculator Microsoft Corporation 08-Dec-15 10.1512.4020.0
Camera Microsoft Corporation 30-Oct-15 2015.1078.40.0
CCleaner Piriform 09-Dec-15 5.12
Close Your Eyes Yai Gameworks 08-Sep-15
Command & Conquer™ Red Alert 2 and Yuri’s Revenge Electronic Arts, Inc. 12-Oct-15 1.91 GB 1.0.0.0
Creative System Information Creative Technology Limited 20-Aug-15 1.10
Cyberpunk 3776 Peter Hann 20-Sep-15
Dark Souls: Prepare to Die Edition FromSoftware 19-Aug-15
DARK SOULS™ II FromSoftware, Inc 19-Aug-15
Darkest Dungeon Red Hook Studios 19-Aug-15
Dead Space EA Redwood Shores 22-Aug-15
Deluge 1.3.12 14-Sep-15
Demigod Gas Powered Games 22-Aug-15
Disney Infinity 3.0: Play Without Limits Avalanche 05-Dec-15
Don't Starve Klei Entertainment 29-Aug-15
Don't Starve Together Beta Klei Entertainment 29-Aug-15
Dota 2 Valve 19-Aug-15 13.9 GB
Dying Light Techland 21-Aug-15
Elements: Soul of Fire Soul Catapult 20-Sep-15
ENSLAVED™: Odyssey to the West™ Premium Edition Ninja Theory 22-Aug-15
ESET Online Scanner v3 08-Dec-15
Evolve Turtle Rock Studios 19-Aug-15
Fallout 4 Bethesda Game Studios 02-Dec-15
FORCED BetaDwarf 15-Sep-15
Forged Alliance Forever FAF Community 08-Nov-15 87.8 MB 242.10.125
Fraps 19-Aug-15
FTL: Faster Than Light Subset Games 01-Sep-15
Get Office Microsoft Corporation 19-Nov-15 17.6418.23501.0
Get Skype Skype 19-Aug-15 3.2.1.0
Get Started Microsoft Corporation 10-Nov-15 2.5.6.0
Google Chrome Google Inc. 19-Aug-15 301 MB 47.0.2526.80
Groove Music Microsoft Corporation 11-Nov-15 3.6.15131.0
Guitar Pro 6 Arobas Music 19-Aug-15 3.61 GB
Hektor Rubycone 20-Sep-15
HELLDIVERS™ Arrowhead Game Studios 07-Dec-15
Heroes of Might & Magic V Nival 29-Aug-15
Hitman: Absolution IO Interactive 28-Sep-15
Intergalactic Bubbles Hellscape Games 20-Sep-15
iTunes Apple Inc. 20-Sep-15 218 MB 12.3.0.44
Killing Floor Tripwire Interactive 19-Aug-15
Killing Floor 2 Tripwire Interactive 04-Sep-15
Left 4 Dead 2 Valve 19-Aug-15
LG AirDrive LG Electronics 07-Dec-15 8.37 MB 1.0.50707.11
LG Bridge LG Electronics 07-Dec-15 1.1.18
LG Mobile Drivers LG Electronics 07-Dec-15 8.51 MB 4.0.3
Logitech Camera Controller LOGITECH Europe S.A. 14-Sep-15 1.0.0.135
Magicka Arrowhead Game Studios 20-Aug-15
Mail and Calendar Microsoft Corporation 17-Nov-15 17.6416.42001.0
Malwarebytes Anti-Malware version 2.2.0.1024 Malwarebytes 07-Dec-15 66.1 MB 2.2.0.1024
Maps Microsoft Corporation 17-Nov-15 4.1511.3161.0
Mass Effect BioWare 20-Aug-15
Mass Effect 2 BioWare 22-Aug-15
Microsoft .NET Framework 4 Client Profile 19-Aug-15
Microsoft Solitaire Collection Microsoft Studios 10-Nov-15 3.5.11021.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 19-Aug-15 4.89 MB 8.0.59193
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 05-Oct-15 13.2 MB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 19-Aug-15 10.2 MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 05-Oct-15 10.1 MB 9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 Microsoft Corporation 19-Aug-15 13.8 MB 10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 Microsoft Corporation 19-Aug-15 11.1 MB 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 Microsoft Corporation 02-Oct-15 11.0.60610.1
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 Microsoft Corporation 19-Aug-15 20.5 MB 11.0.61030.0
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 Microsoft Corporation 09-Nov-15 17.3 MB 11.0.61030.0
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 Microsoft Corporation 12-Oct-15 20.5 MB 12.0.30501.0
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 Microsoft Corporation 20-Aug-15 17.1 MB 12.0.30501.0
Microsoft XNA Framework Redistributable 3.1 Microsoft Corporation 20-Sep-15 10.0 MB 3.1.10527.0
Middle-earth: Shadow of Mordor Monolith Productions, Inc. 20-Aug-15
MIDI-OX MIDIOX Computing 27-Nov-15 1.99 MB 7.02.372
Might & Magic: Heroes VI Blackhole 29-Aug-15
Money Microsoft Corporation 17-Nov-15 4.7.118.0
Movie Edit Touch MAGIX Software GmbH 27-Sep-15 4.36.71.0
Movies & TV Microsoft Corporation 19-Nov-15 3.6.15361.0
Mumble 1.2.10 Thorvald Natvig 08-Nov-15 33.0 MB 1.2.10
News Microsoft Corporation 17-Nov-15 4.7.118.0
NVIDIA 3D Vision Controller Driver 352.65 NVIDIA Corporation 01-Dec-15 352.65
NVIDIA 3D Vision Driver 359.06 NVIDIA Corporation 01-Dec-15 359.06
NVIDIA GeForce Experience 2.7.4.10 NVIDIA Corporation 01-Dec-15 2.7.4.10
NVIDIA Graphics Driver 359.06 NVIDIA Corporation 01-Dec-15 359.06
NVIDIA HD Audio Driver 1.3.34.4 NVIDIA Corporation 01-Dec-15 1.3.34.4
NVIDIA PhysX NVIDIA Corporation 07-Dec-15 9.25 MB 9.12.1031
OneNote Microsoft Corporation 03-Dec-15 17.6366.15651.0
OpenAL 20-Sep-15
Origin Electronic Arts, Inc. 08-Oct-15 9.7.2.53208
Particula Microblast Games 20-Sep-15
PAYDAY 2 OVERKILL - a Starbreeze Studio. 19-Aug-15
PCSX2 - Playstation 2 Emulator 29-Aug-15
People Microsoft Corporation 03-Dec-15 10.0.3350.0
Phone Companion Microsoft Corporation 20-Nov-15 10.1511.18010.0
Photos Microsoft Corporation 04-Dec-15 15.1201.10020.0
Pixel Piracy Vitali Kirpu 30-Sep-15
President for a Day - Corruption Serious Games Interactive 20-Sep-15
President for a Day - Floodings Serious Games Interactive 20-Sep-15
Prison Architect Introversion Software 10-Sep-15
R.U.S.E Eugen Systems 14-Sep-15
Realtek Ethernet Controller Driver Realtek 19-Aug-15 2.92 MB 7.65.1025.2012
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 19-Aug-15 40.7 MB 6.0.1.7535
Risk of Rain 22-Aug-15
Sid Meier's Civilization V 2K Games, Inc. 22-Nov-15
Sound Blaster Tactic(3D) Creative Technology Limited 20-Aug-15 1.0
Sports Microsoft Corporation 24-Nov-15 4.7.130.0
SpyHunter 4 Enigma Software Group, LLC 07-Dec-15 4.21.10.4584
Star Wars - Battlefront II Pandemic Studios 09-Nov-15
Store Microsoft Corporation 19-Nov-15 2015.23.23.0
Super Amazing Wagon Adventure sparsevector 22-Aug-15
Supreme Commander 2 Gas Powered Games 20-Oct-15
Supreme Commander: Forged Alliance Gas Powered Games 29-Oct-15
Tales from the Borderlands Telltale Games 19-Aug-15
TeamSpeak 3 Client TeamSpeak Systems GmbH 19-Aug-15 3.0.17
Terraria Re-Logic 22-Aug-15
The Elder Scrolls V: Skyrim Bethesda Game Studios 22-Aug-15
The Tower Of Elements Wulo Games 20-Sep-15
The Witcher 3: Wild Hunt CD PROJEKT RED 19-Aug-15
Tobe's Vertical Adventure Secret Base 20-Sep-15
TOXIKK Reakktor Studios 14-Sep-15
TVersity Codec Pack 1.7 TVersity Inc. 20-Aug-15 1.7
TVersity Media Server 3.7.1 TVersity 20-Aug-15 3.7.1
Ubisoft Game Launcher UBISOFT 15-Sep-15 1.0.0.0
VLC media player VideoLAN 25-Aug-15 2.2.1
Voice Recorder Microsoft Corporation 20-Nov-15 10.1511.17110.0
Weather Microsoft Corporation 17-Nov-15 4.7.118.0
WestwoodOnline WestwoodOnline 12-Oct-15 965 KB 1.0.0.0
Windows DVD Player Microsoft Corporation 12-Nov-15 3.6.13291.0
WinRAR 5.21 (32-bit) win.rar GmbH 13-Sep-15 5.21.0
Xbox Microsoft Corporation 20-Nov-15 11.11.19012.0
XCOM: Enemy Unknown Firaxis Games 14-Sep-15
 
 


#6 buddy215

buddy215

  • Moderator
  • 13,196 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:16 AM

Posted 09 December 2015 - 04:31 PM

If the problem is still happening after the reset of Chrome then you will need to do a clean uninstall of Chrome...that means removing

your Chrome Profile, too.

 

Usually there would be a Startup for that adware and visable in CCleaner...perhaps that was removed by another program you used.

 

I'm assuming the Eset Online Scan found nothing as you didn't post any results of the scan.

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

You have Windows 10 but I think the instructions below for 8 will work.....

  1. Close all Chrome windows and tabs.
  2. Go to the Start menu > Control Panel. (Windows 8 users: Learn how to access the Control Panel)
  3. Click Programs and Features.
  4. Double-click Google Chrome.
  5. Click Uninstall from the confirmation dialog. If you want to delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.

Did the browser come packaged with other software on your computer? If so, your version of Google Chrome may be installed system-wide and you'll need to log in to a user account with administrative rights on your computer to uninstall the browser. Uninstalling a system-wide version of Google Chrome removes the browser for all user accounts on your computer.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users