Malware/adware Returns

cheyenne · Apr 3, 2016

Hello, and thank you in advance. I tutor an older woman in a nursing home on PC use and she is having Adware problems on her PC. I offered to help her remove it, she gets so much joy from her PC! But I'm stuck, no matter what I do it comes back and leaves her PC unusable due to constant browser redirects. I have attached FRST logs here and attached the first two Malwarebytes logs. I also reset all the browsers (using refresh on Firefox, renaming default user file in Chrome to Default 2 and resetting Edge) on her machine after the second scan, to no avail. The only thing I see is that a program named Trezaa is still installed, but I can't uninstall since its .exe file is in quarantine. I was afraid putting it back to uninstall might do more harm than good.

chaslang · Apr 3, 2016

If you wish to continue to work on this problem here at Major Geeks then you need to go to your thread at Malwarebytes and ask to have it closed because you are already receiving help here. I'm referring to the below cross forum posting which you should not do as it ties up valuable resources at multiple locations:

https://forums.malwarebytes.org/topic/181248-malwareadware-keeps-returning/

Begin by uninstalling Spybot.

Now make sure that your antivirus is disabled. See the below link for help on disabling it.

How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Please download ZOEK and save it to your desktop (preferred version is the *.exe one - upper left corner).

http://hijackthis.nl/smeenk/

Attached to the bottom of this message you will find a file called zoekscript.txt

Download it too and save to your desktop - _it needs to be in the same location as the ZOEK tool

Drag zoekscript file and drop it onto ZOEK icon - this should launch the program:

The scan may take a while and may need a reboot.

Upon completion a file zoek-results should appear.

Attach it to your next reply.

Now download the attached fixlist.txt file found at the bottom of this message and save fixlist.txt on your Desktop. Make sure you save it as a txt file in the same location as FRST

You should now have both fixlist.txt and FRST64.exe on your Desktop.

Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).

Run FRST64.exe by right clicking on it and selecting Run As Adminstrator

Click the Fix button just once and wait.

Your computer should reboot after the fix runs.

Reconnect your internet connection after reboot so you can come back here to continue.

The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)

Then attach the below logs:

Fixlog.txt

zoek-results

If you are still having problems then you really need to fully follow the instructions in the below link.

READ & RUN ME FIRST Malware Removal Guide (incl. spyware, virus, trojan, hijacker)

cheyenne · Apr 3, 2016

Thank you! Sorry if I violated protocol by posting in both forums, I'm a teacher by day and MinorGeek in my spare time. The computer belongs to a woman in a nursing home, I will not be able to start until tomorrow after work. I'm not quite sure how to close a thread in Malwarebytes, but I posted that I was receiving help here. I uninstalled Spybot after I ran it, there were too many entries for things that obviously were part of the system.

cheyenne · Apr 5, 2016

chaslang said: ↑

If you wish to continue to work on this problem here at Major Geeks then you need to go to your thread at Malwarebytes and ask to have it closed because you are already receiving help here. I'm referring to the below cross forum posting which you should not do as it ties up valuable resources at multiple locations:

https://forums.malwarebytes.org/topic/181248-malwareadware-keeps-returning/

Begin by uninstalling Spybot.

Now make sure that your antivirus is disabled. See the below link for help on disabling it.

How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Please download ZOEK and save it to your desktop (preferred version is the *.exe one - upper left corner).

http://hijackthis.nl/smeenk/

Attached to the bottom of this message you will find a file called zoekscript.txt

Download it too and save to your desktop - _it needs to be in the same location as the ZOEK tool

Drag zoekscript file and drop it onto ZOEK icon - this should launch the program:

The scan may take a while and may need a reboot.

Upon completion a file zoek-results should appear.

Attach it to your next reply.

Now download the attached fixlist.txt file found at the bottom of this message and save fixlist.txt on your Desktop. Make sure you save it as a txt file in the same location as FRST

You should now have both fixlist.txt and FRST64.exe on your Desktop.

Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).

Run FRST64.exe by right clicking on it and selecting Run As Adminstrator

Click the Fix button just once and wait.

Your computer should reboot after the fix runs.

Reconnect your internet connection after reboot so you can come back here to continue.

The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)

Then attach the below logs:

Fixlog.txt

zoek-results

If you are still having problems then you really need to fully follow the instructions in the below link.

READ & RUN ME FIRST Malware Removal Guide (incl. spyware, virus, trojan, hijacker)
Click to expand...

cheyenne · Apr 5, 2016

Both tools have been run and the logs are attached. Thank you!

chaslang · Apr 5, 2016

You're welcome. How is the PC working now?

cheyenne · Apr 5, 2016

So far so good. I did not encounter any pop-ups or browser redirects. I installed Spyware Blaster and told her to periodically update it. I advised her to leave MalwareBytes installed and to scan periodically, admonishing her to never delete the quarantine, since no software is perfect. I also demonstrated how easily even installing something innocent like Java could change home pages, and search preferences, plus install other software if you did not read carefully, and warned her not to download updates from random popups. I think that is what happened, she was getting lots of those "flash is out of date update now" messages. But, you gotta love an 8o something woman learning computers for the first time! Thank you so much; hopefully, that's the end of it - if not I know the drill .

chaslang · Apr 7, 2016

You're welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your Windows version in this link: Disable And Enable System Restore

For Windows 8 and 8.1 system restore see this link: Win 8 System Restore - How to enable/disable

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Malware/adware Returns

cheyenne Private E-2

Attached Files:

4 - 2 Log.txt

Addition.txt

FRST.txt

Malwarebytes log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Attached Files:

zoekscript.txt

fixlist.txt

cheyenne Private E-2

cheyenne Private E-2

cheyenne Private E-2

Attached Files:

Fixlog.txt

zoek-results.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

cheyenne Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Malware/adware Returns

cheyenne Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Attached Files:

cheyenne Private E-2

cheyenne Private E-2

cheyenne Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

cheyenne Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches