Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't remove malware from PC


  • Please log in to reply
12 replies to this topic

#1 Amosst

Amosst

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 07 May 2017 - 08:25 AM

Hi,

 

For a while now I noticed that my PC has been infected with adware and malware. I constantly recieved messages from Avast saying that a PUP has been blocked, and with Malwarebytes, Avast AND adwcleaner I have removed the threats, only to see them return every time I reboot my PC. I tried resetting my PC (I don't have any important files on this PC anyway), but when I reset my PC it says that some personal files could not been removed. After I booted my freshly resetted PC, I instantly installed malwarebytes and it discovered malware again. However, adwcleaner doesn't detect any threats anymore, although I am sure they are still here.

​I don't know how to remove this virus, and I would appreciate some help.

 

Amos


Edited by hamluis, 07 May 2017 - 09:09 AM.
Moved from MRL to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,097 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:15 PM

Posted 07 May 2017 - 05:03 PM

Welcome to BC....

 

I know you have used one or more of the programs below so if you have them installed just continue with the remainder of directions to

run a new scan using them and post their results so as we are on the same page.

 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

  • download Malwarebytes to your desktop.
  • Double-click mb3-setup-1878.1878-3.0.6.1469.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
  • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.

Download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 Amosst

Amosst
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 08 May 2017 - 09:47 AM

 

Welcome to BC....

 

I know you have used one or more of the programs below so if you have them installed just continue with the remainder of directions to

run a new scan using them and post their results so as we are on the same page.

 

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

 

  • download Malwarebytes to your desktop.
  • Double-click mb3-setup-1878.1878-3.0.6.1469.exe and follow the prompts to install the program.
  • Then click Finish.
  • Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  • If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  • When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  • Restart your computer when prompted to do so.
  • The Scan log is available throughout History ->Application logs. Please post it contents in your next reply.

Download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message
  • Hold down Control and click on this link to open ESET OnlineScan in a new window.
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

 

 

 

 

Thank you for your reply.

 

As I mentioned earlier, I reset my PC and deleted everything before starting this topic. I did everything you suggested, but none of the options detected malware. I am not sure if the malware has been removed because of the reset or if it is hiding in a very deep spot...

 

 

 

Anyway, I don't know if it helps but here are the results (it is in Dutch, but there were no threats found anyway)

 

 

 

 

MalwareBytes:

 

 

Malwarebytes
www.malwarebytes.com
-Logboekdetails-
Scandatum: 08-05-17
Scantijd: 15:55
Logboekbestand: MB report.txt
Beheerder: Ja
-Software-informatie-
Versie: 3.0.6.1469
Versie componenten: 1.0.103
Update pakketversie: 1.0.1895
Licentie: Proef
-Systeeminformatie-
Besturingssysteem: Windows 10
Processor: x64
Bestandssysteem: NTFS
Gebruiker: DESKTOP-33QCJSD\amoss
-Scansamenvatting-
Scantype: Bedreigingsscan
Resultaat: Voltooid
Objecten gescand: 358859
Verstreken tijd: 0 min, 19 sec
-Scanopties-
Geheugen: Ingeschakeld
Opstarten: Ingeschakeld
Bestandssysteem: Ingeschakeld
Archieven: Ingeschakeld
Rootkits: Uitgeschakeld
Heuristiek: Ingeschakeld
POP: Ingeschakeld
POA: Ingeschakeld
-Scandetails-
Proces: 0
(Geen kwaadaardige items gedetecteerd)
Module: 0
(Geen kwaadaardige items gedetecteerd)
Registersleutel: 0
(Geen kwaadaardige items gedetecteerd)
Registerwaarde: 0
(Geen kwaadaardige items gedetecteerd)
Registerdata: 0
(Geen kwaadaardige items gedetecteerd)
Gegevensstroom: 0
(Geen kwaadaardige items gedetecteerd)
Map: 0
(Geen kwaadaardige items gedetecteerd)
Bestand: 0
(Geen kwaadaardige items gedetecteerd)
Fysieke sector: 0
(Geen kwaadaardige items gedetecteerd)

(end)

 

 

 

 

 

 

 

AdwCleaner:

 

 

# AdwCleaner v6.046 - Logbestand aangemaakt 08/05/2017 op 16:01:22
# Bijgewerkt op 24/04/2017 door Malwarebytes
# Database : 2017-05-05.1 [Lokaal]
# Besturingssysteem : Windows 10 Pro  (X64)
# Gebruikersnaam : amoss - DESKTOP-33QCJSD
# Gestart vanuit : C:\Users\amoss\Downloads\adwcleaner_6.046.exe
# Mode: Scannen
# Ondersteuning : https://www.malwarebytes.com/support
 
***** [ Services ] *****
Geen kwaadaardige services gevonden.

***** [ Mappen ] *****
Geen kwaadaardige mappen gevonden.

***** [ Bestanden ] *****
Geen kwaadaardige bestanden gevonden.

***** [ DLL ] *****
Geen kwaadaardige DLLs gevonden.

***** [ WMI ] *****
Geen kwaadaardige sleutels gevonden.

***** [ Snelkoppelingen ] *****
Geen geïnfecteerde snelkoppeling gevonden.

***** [ Geplande Taken ] *****
Geen kwaadaardige taak gevonden.

***** [ Register ] *****
Geen kwaadaardige register waardes gevonden.

***** [ Internetbrowsers ] *****
Geen kwaadaardige op Firefox gebaseerde browser items gevonden.
Geen kwaadaardige op Chromium gebaseerde browser items gevonden.
*************************
C:\AdwCleaner\AdwCleaner[S0].txt - [1302 bytes] - [07/05/2017 14:52:12]
C:\AdwCleaner\AdwCleaner[S1].txt - [1375 bytes] - [08/05/2017 15:48:06]
C:\AdwCleaner\AdwCleaner[S2].txt - [1296 bytes] - [08/05/2017 16:01:22]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1369 bytes] ##########

 

 

 

 

JRT:

 

 

 

Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 10 Pro x64
Ran by amoss (Administrator) on 08/05/2017 at 16:04:34.22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

File System: 0
 

Registry: 0
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08/05/2017 at 16:04:58.68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

NOTE: During the JRT scan, it said failed to create restore point, but I could continue anyway.

 

 

 

 

 

 

ESET: 0 threats found, so no report available



#4 buddy215

buddy215

  • Moderator
  • 13,097 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:15 PM

Posted 08 May 2017 - 11:24 AM

If you reformatted and reinstalled your Windows OS then you would of removed all malware and adware from the computer.

Most adware is bundled with free programs...even the most commonly used ones. There is a website that hosts many of those

free programs without their bundled adware......Ninite - Install or Update Multiple Apps at Once


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#5 Amosst

Amosst
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 08 May 2017 - 12:19 PM

If you reformatted and reinstalled your Windows OS then you would of removed all malware and adware from the computer.

Most adware is bundled with free programs...even the most commonly used ones. There is a website that hosts many of those

free programs without their bundled adware......Ninite - Install or Update Multiple Apps at Once

 

Thank you! So I guess I removed all the malware by resetting my PC then, I was just worried because windows wasn't able to delete some personal files so I thought maybe the malware was still hiding there.

 

Do you know of an app or method with which I can download all my drivers easily other than going to the sites of my PC components?



#6 buddy215

buddy215

  • Moderator
  • 13,097 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:15 PM

Posted 08 May 2017 - 12:30 PM

Whatever you do....don't use one of those sites that claims to update drivers. If you used the factory image to reinstall your OS then I would

think that would get all drivers except for some hardware you upgraded such as video cards. That's assuming you used the factory image that

came with the computer...not a custom built computer or an install disk supplied by Microsoft.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#7 Amosst

Amosst
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 08 May 2017 - 12:44 PM

Whatever you do....don't use one of those sites that claims to update drivers. If you used the factory image to reinstall your OS then I would

think that would get all drivers except for some hardware you upgraded such as video cards. That's assuming you used the factory image that

came with the computer...not a custom built computer or an install disk supplied by Microsoft.

 

I will keep that in mind... I reset my PC using the troubleshoot option after rebooting, and then selecting the option that deletes everything. I have a custom built computer, so then I will have to manually update the drivers I guess. 



#8 Amosst

Amosst
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 09 May 2017 - 09:42 AM

Whatever you do....don't use one of those sites that claims to update drivers. If you used the factory image to reinstall your OS then I would

think that would get all drivers except for some hardware you upgraded such as video cards. That's assuming you used the factory image that

came with the computer...not a custom built computer or an install disk supplied by Microsoft.

 

 

I'm back... After booting my pc today, I scanned for threats with malwarebytes just for sure, and nothing was found.
However, after that I scanned with adwcleaner and it found 1 file, I don't know if this file is infected or not.
Here is the report, its the Utils file

 

 

# AdwCleaner v6.046 - Logbestand aangemaakt 09/05/2017 op 16:38:35
# Bijgewerkt op 24/04/2017 door Malwarebytes
# Database : 2017-05-08.1 [Server]
# Besturingssysteem : Windows 10 Pro  (X64)
# Gebruikersnaam : amoss - DESKTOP-33QCJSD
# Gestart vanuit : C:\Users\amoss\Downloads\adwcleaner_6.046.exe
# Mode: Scannen
 
 
 
***** [ Services ] *****
 
Geen kwaadaardige services gevonden.
 
 
***** [ Mappen ] *****
 
Geen kwaadaardige mappen gevonden.
 
 
***** [ Bestanden ] *****
 
Bestand gevonden:  C:\Users\amoss\AppData\Local\Temp\Utils.dll
 
 
***** [ DLL ] *****
 
Geen kwaadaardige DLLs gevonden.
 
 
***** [ WMI ] *****
 
Geen kwaadaardige sleutels gevonden.
 
 
***** [ Snelkoppelingen ] *****
 
Geen geïnfecteerde snelkoppeling gevonden.
 
 
***** [ Geplande Taken ] *****
 
Geen kwaadaardige taak gevonden.
 
 
***** [ Register ] *****
 
Geen kwaadaardige register waardes gevonden.
 
 
***** [ Internetbrowsers ] *****
 
Geen kwaadaardige op Firefox gebaseerde browser items gevonden.
Geen kwaadaardige op Chromium gebaseerde browser items gevonden.
 
*************************
 
C:\AdwCleaner\AdwCleaner[S0].txt - [1302 bytes] - [07/05/2017 14:52:12]
C:\AdwCleaner\AdwCleaner[S1].txt - [1375 bytes] - [08/05/2017 15:48:06]
C:\AdwCleaner\AdwCleaner[S2].txt - [1448 bytes] - [08/05/2017 16:01:22]
C:\AdwCleaner\AdwCleaner[S3].txt - [1394 bytes] - [09/05/2017 16:38:35]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1467 bytes] ##########


#9 buddy215

buddy215

  • Moderator
  • 13,097 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:15 PM

Posted 09 May 2017 - 11:23 AM

I don't know what that is. It's in the temp folder so I would think it is safe to delete it...may require a reboot.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#10 Amosst

Amosst
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 10 May 2017 - 09:28 AM

I don't know what that is. It's in the temp folder so I would think it is safe to delete it...may require a reboot.

 

 

Today I did another adwcleaner scan, and the only thing it found was a search provider called luckystarting.com. Here is the text report:

 

 
 
# AdwCleaner v6.046 - Logbestand aangemaakt 10/05/2017 op 16:23:56
# Bijgewerkt op 24/04/2017 door Malwarebytes
# Database : 2017-05-09.1 [Server]
# Besturingssysteem : Windows 10 Pro  (X64)
# Gebruikersnaam : amoss - DESKTOP-33QCJSD
# Gestart vanuit : C:\Users\amoss\Downloads\adwcleaner_6.046.exe
# Mode: Scannen
 
 
 
***** [ Services ] *****
 
Geen kwaadaardige services gevonden.
 
 
***** [ Mappen ] *****
 
Geen kwaadaardige mappen gevonden.
 
 
***** [ Bestanden ] *****
 
Geen kwaadaardige bestanden gevonden.
 
 
***** [ DLL ] *****
 
Geen kwaadaardige DLLs gevonden.
 
 
***** [ WMI ] *****
 
Geen kwaadaardige sleutels gevonden.
 
 
***** [ Snelkoppelingen ] *****
 
Geen geïnfecteerde snelkoppeling gevonden.
 
 
***** [ Geplande Taken ] *****
 
Geen kwaadaardige taak gevonden.
 
 
***** [ Register ] *****
 
Geen kwaadaardige register waardes gevonden.
 
 
***** [ Internetbrowsers ] *****
 
Geen kwaadaardige op Firefox gebaseerde browser items gevonden.
Chromium pref gevonden:  [C:\Users\amoss\AppData\Local\Google\Chrome\User Data\Default\Web data] - luckystarting.com
 
*************************
 
C:\AdwCleaner\AdwCleaner[C0].txt - [1317 bytes] - [09/05/2017 17:34:32]
C:\AdwCleaner\AdwCleaner[S0].txt - [1302 bytes] - [07/05/2017 14:52:12]
C:\AdwCleaner\AdwCleaner[S1].txt - [1375 bytes] - [08/05/2017 15:48:06]
C:\AdwCleaner\AdwCleaner[S2].txt - [1448 bytes] - [08/05/2017 16:01:22]
C:\AdwCleaner\AdwCleaner[S3].txt - [1546 bytes] - [09/05/2017 16:38:35]
C:\AdwCleaner\AdwCleaner[S4].txt - [1667 bytes] - [09/05/2017 22:55:30]
C:\AdwCleaner\AdwCleaner[S5].txt - [1640 bytes] - [10/05/2017 16:23:56]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [1713 bytes] ##########
 
 
Do you think this is adware that 'infects' my chrome?


#11 buddy215

buddy215

  • Moderator
  • 13,097 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:15 PM

Posted 10 May 2017 - 11:25 AM

You must be doing a lot of risky stuff like installing free apps that are bundled with adware, downloading free games, movies, music.

 

Of course it is adware. Remove the LuckyStarting.com Home Page Hijacker


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#12 Amosst

Amosst
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:02:15 AM

Posted 10 May 2017 - 12:46 PM

You must be doing a lot of risky stuff like installing free apps that are bundled with adware, downloading free games, movies, music.

 

Of course it is adware. Remove the LuckyStarting.com Home Page Hijacker

 

 

 

Literally the only apps I've installed since the reset are the virus scanners + apps I downloaden with Ninite like Spotify, Steam, etc....  So I am sure it didn't come with recently installed programs.

I followed all the steps of the removal guide, and out of all the steps only adwcleaner found the luckystarting hijacker, so I deleted it and after the reboot it didn't find anything.



#13 buddy215

buddy215

  • Moderator
  • 13,097 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:07:15 PM

Posted 10 May 2017 - 01:16 PM

Good...

 

If you don't have an ad blocker I suggest you install this one...Adblock Plus. Once installed click on the ABP icon at the top of the browser and choose

Filter Preferences. Then UNcheck the box next to Allow some non-intrusive advertisements.

Adblock Plus - Chrome Web Store   Adblock Plus :: Add-ons for Firefox

 

Block the install of Third party cookies....also known as ad/ tracking cookies. Once you have blocked them, run CCleaner to remove the existing ones.

How to disable third-party cookies in all major web browsers


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users