Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Botware Infection?

  • This topic is locked This topic is locked
1 reply to this topic

#1 mwright0825


  • Members
  • 3 posts
  • Local time:10:56 AM

Posted 14 June 2016 - 09:24 PM

 Ok, so  my son is 12 and into coding, and way more advanced than I am, and has somehow managed to get a bot infection, which i haven't been able to remove. I have been unable to use system restore, can't get it off with malwarebytes, superantispyware, or McAfee.  It lets me get to the point where it is nearly removed, then gives me a false blue microsoft error screen, but i am able to use the windows key to restart the computer.  I don't even really know what a bot is, but my provider emailed me stating that they noticed one on our device? Can anyone help me please? My IT manager referred me to your site. I have attached my logs from Farbar Recovery.

Attached Files

BC AdBot (Login to Remove)


#2 nasdaq


  • Malware Response Team
  • 40,213 posts
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:56 AM

Posted 16 June 2016 - 09:42 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.


() C:\Program Files (x86)\4C4C4544-1465591311-5A10-8057-B5C04F4C4A31\knsr71C8.tmp
HKU\S-1-5-21-2619785817-683864586-3234668310-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
FF NewTab: hxxp://www.safesear.ch/?type=20160226-170-ff-nt
FF DefaultSearchEngine: SafeSearch
FF SearchEngineOrder.1: SafeSearch
FF Keyword.URL: hxxp://www.safesear.ch/web/?type=ss-ff-kw&q=
FF HKLM-x32\...\Firefox\Extensions: [{jid1-vS7biDmom8YxhA@jetpack}] - C:\Users\Cohen\AppData\Roaming\Mozilla\Firefox\Profiles\byfhtdg0.default\extensions\{jid1-vS7biDmom8YxhA@jetpack} => not found
CHR Extension: (Chrome Web Store Payments) - C:\Users\Cohen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
R2 kunuvybezbt; C:\Program Files (x86)\4C4C4544-1465591311-5A10-8057-B5C04F4C4A31\knsr71C8.tmp [188928 2016-06-14] () [File not signed]
S2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-06-10] () [File not signed]
S2 Mydtip; "C:\Users\Cohen\AppData\Roaming\HubpulDoc\Jeszedi.exe" -cms [X]
U3 idsvc; no ImagePath
U3 wpcsvc; no ImagePath
C:\Program Files (x86)\4C4C4544-1465591311-5A10-8057-B5C04F4C4A31
C:\Users\Cohen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

Please post the log and include the Addition.txt log that was created by the Farbar tool.

Let me know what problem persists.


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users