rand new laptop (seemingly) had malware on, can't get rid of cookies

Hi all, have been advised to post here. Here is the link to the original thread. http://www.bleepingcomputer.com/forums/t/607162/my-brand-new-laptop-is-infected-and-i-am-at-end-of-tether/page-3

 

I am concerned as to why SuperAntiSpyware found so many cookies when had only ever visited that site to download the free program.

 

Every SAS scan since (including after the nasties have been removed by that program) shows 600-1000 PUPs on the computer, which reappear whenever I shut it down and switch it off fr the day.

 

Are the logs on that thread's 3rd page anything to be concerned about? I will repost the last one here, if that is okay, guys.

 

Hello Martin_P and welcome to Bleeping Computer.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please complete these tasks in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.

• shut down your protection software now to avoid potential conflicts.
• run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
• the tool will open and start scanning your system
• please be patient as this can take a while to complete depending on your system's specifications
• on completion, a log (JRT.txt) is saved to your desktop and will automatically open
• post the contents of JRT.txt into your next message.

===================================================

Download Malwarebytes-Anti-Malware

Click here.
 

• double-click mbam-setup.exe and follow the prompts to install the program – (Note: Vista & Windows 7, 8, 10 users, please right-click and select “Run as Administrator”)
• select the “Scan” tab at the top
• there are three scan types; choose Threat Scan, then click on Scan
• when the scan is complete, if no malicious items are found you can close the program
• if malicious items are found be sure that everything is checked and click Quarantine
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include with next post:

AdwCleaner log
JRT.txt
Mbam.txt

Thanks

Satchfan
 

Edited by satchfan, 09 March 2016 - 12:28 PM.

Satchfan, thanks for your reply; sorry I didn't respond to it yesterday, it was a mad day!! My following posts will be the logs in the requested order.

ADWARE CLEANER: said the computer is clean; here's the logfile:

 

JRT:

 

MALWAREBYTES: found nothing, so no removal or log produced.

sorry I didn't respond to it yesterday, it was a mad day!!

 

We all have busy lives and finding spare time is not always easy so not to worry. The only thing that I ask is if your reply is going to be delayed for more than 3 days that you let me know.

 

 

There should have been a log even if it found nothing.

Open Malwarebytes, click on History > Application Logs. Open the last scan by double-clicking on it. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select "Copy to clipboard"; that copies the full log to the windows clipboard, so in your reply, right click in the text field and select "Paste", (or press Ctrl+V).

===================================================

Run Farbar Recovery Scan Tool

We'll have a look with a different tool to be sure there is nothing sinister on your computer.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

Mbam.txt
Frst.txt
Addition.txt

Thanks

Satchfan

 

Ah, thanks - found the log I thought I'd tried to save earlier but failed to do so - it was hiding.

 

MALWARE BYTES LOG:

 

FARBAR LOG:

 

ADDITION:

 

Thanks for the logs.

 

Have to go out for a while so won't reply until later.

No worries, thanks for your help this far, have a great evening! :-)

Warning: Downloading software from Cnet

CNET is increasingly bundling invasive and annoying browser toolbars with software on its site, even some open-source titles whose distribution licenses prohibit such activity. Also, CNET’s own installer is detected by many antivirus products as a Trojan horse, even though the company prefaces each download with the assurance that “CNET hosts this file and has scanned it to ensure it is virus and spyware free.” CNET also has long touted download.com’s zero tolerance policy toward all bundled adware.

================================================

Multiple antiviruses

You have Comodo, McAfee and Avast antivirus programs installed. Although you seem to be using different elements of each, it is a very bad decision.

You can not run two real-time antiviruses at the same time. Although many have different methods of searching for and recognising threats, they will all be 'fighting' in memory to kick each other out, rendering them all ineffective.

You also have more than one firewall which is also a security risk. In the UK it’s usual now to have McAfee pre-installed so it could be that in your case but then why have you installed so many others?

Windows 8.1 comes with a perfectly adequate antivirus and firewall, (Windows Defender & and Windows firewall), and no other is necessary.

Please decide what your choice is and uninstall all but one AV and firewall.

We’ll clean up what I’ve found in your log and then have another look.

================================================

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

HKU\S-1-5-21-332180863-3176859329-4029246278-1001\...\RunOnce: [Application Restart #2] => C:\Users\acer\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe  --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resourc (the data entry has 581 more characters).
HKU\S-1-5-21-332180863-3176859329-4029246278-1001\...\MountPoints2: {f4b33e2e-0b58-11e5-8260-806e6f6e6963} - "D:\SETUP.EXE"
S3 AvgAMPS; "C:\Program Files (x86)\AVG\Av\avgamps.exe" [X]
2016-03-05 09:31 - 2016-03-05 09:31 - 02979288 _____ (AVG Technologies CZ, s.r.o.) C:\Users\acer\Downloads\AVG_Protection_Free_1005.exe
2016-03-05 09:12 - 2016-03-05 09:13 - 05066104 _____ (AVAST Software)
2016-03-04 22:36 - 2016-03-04 22:36 - 00000000 ____D C:\Users\Public\Pokki
C:\Users\acer\Downloads\avast_free_antivirus_setup_online_cnet2 (1).exe
2016-03-05 00:41 - 2016-03-05 00:41 - 03411920 _____ (Check Point Software Technologies Ltd.) C:\Users\acer\Downloads\zafwSetupWeb_141_048_000.exe
2016-03-04 16:40 - 2016-03-05 10:29 - 00000000 ____D C:\Program Files (x86)\AVG
2016-03-04 16:39 - 2016-03-05 14:14 - 00000000 ____D C:\ProgramData\Avg
2016-03-04 16:36 - 2016-03-04 16:36 - 00000000 ____D C:\Users\acer\AppData\Local\Avg
2016-03-04 16:34 - 2016-03-04 16:35 - 02924848 _____ (AVG Technologies CZ, s.r.o.) C:\Users\acer\Downloads\AVG_Protection_Free_1004.exe
C:\Users\acer\AppData\Local\SweetLabs App Platform
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

Logs to include with next post:

Fixlog.txt
checkup.txt

Thanks

Satchfan

 

 

Morning, to answer why there are multiple antivirus progs running: McAfee is just on a 30 day trial and I don't like it as its scans tend to slow everything down, so I will probably remove it, if I can. I think I was just being a bit lazy and doing all my downloading of protection software in one go. 

 

As for Commodo, I thought I was just using it as a fire wall not an antivirus. I installed it because I was unsure whether the Windows one was any good; in light of what you've said, Commodo will go. My defences will then be Avast and the Windows Defender, and thanks very much for your advice on this. I'll apply the fixes as requested, next, and thanks again!

FARBAR: I have located the FRST folder on the C Drive. In it, there are 3 subfolders: 'Hives', 'Logs' and 'Quarantine'. Do I need to save it within any of these subfolders, or as long as it is in the FRST folder itself, is this okay? 

My defences will then be Avast and the Windows Defender

Windows Defender is the default real-time, (always on), antivirus in Windows 8.1. Unlike the one in Windows XP, Vista and 7, the Windows 8.1 version is a full-on antivirus and the only one you'll need. I suggest that you uninstall Avast otherwise you'll still have 2 antiviruses running.

Windows Defender & Windows firewall are what protected my 8.1 before I upgraded to Windows 10, (and they still are). They are more than adequate as an AV & firewall.


Re FRST, those folders are not what I want you to move, just the FRST program located at C:\Users\acer\Downloads\FRST.