Roll Around malware

Vako · Mar 12, 2015

Tried every AV they found the malware deleted them but still popping ads and tabs. now AV wont find the malware but it stiill there..

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/12/2015
Scan Time: 2:21:49 AM
Logfile: scan.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.03.12.02
Rootkit Database: v2015.02.25.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: TxnerT

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 446336
Time Elapsed: 17 min, 44 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 4
PUP.Optional.BoostSaves.A, C:\Users\TxnerT\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.boostsaves.com_0.localstorage, Delete-on-Reboot, [564ccf75563466d0532d8a2d34cff60a],
PUP.Optional.BoostSaves.A, C:\Users\TxnerT\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.boostsaves.com_0.localstorage-journal, Delete-on-Reboot, [f7abdb69ef9b74c293ede2d53fc4a957],
PUP.Optional.Boost.A, C:\Users\TxnerT\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.boostsaves.com_0.localstorage, Delete-on-Reboot, [e6bc60e4dab02b0b7ec65d74cc372bd5],
PUP.Optional.Boost.A, C:\Users\TxnerT\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.boostsaves.com_0.localstorage-journal, Delete-on-Reboot, [acf671d390fabb7b91b3d3fedb281fe1],

Physical Sectors: 0
(No malicious items detected)

(end)

TimW · Mar 12, 2015

Which browser are you having the problems with?

Vako · Mar 12, 2015

Happens in Chrome

TimW · Mar 12, 2015

Try doing this:
Reset Chrome to Defaults

Let me know how things are running after doing the above.

Vako · Mar 12, 2015

Got worse

TimW · Mar 12, 2015

Rerun Hitman and delete all the cookies. Reboot and rescan with Hitman and attach the new log.

Vako · Mar 12, 2015

Code:

HitmanPro 3.7.9.212
www.hitmanpro.com

   Computer name . . . . : LEGEND
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Legend\TxnerT
   UAC . . . . . . . . . : Disabled
   License . . . . . . . : Paid (255 days left)

   Scan date . . . . . . : 2015-03-12 15:41:13
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 11m 46s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 0

   Objects scanned . . . : 2,453,706
   Files scanned . . . . : 35,662
   Remnants scanned  . . : 525,538 files / 1,892,506 keys

Issue still persists. Says reboot no cuz i closed it then did a normal reboot.

TimW · Mar 12, 2015

Please download ComboFix to your desktop. Turn off any AV software you have before you run it. Attach the log when finished. Do not do anything while it is running or it may stall the program.

Vako · Mar 12, 2015

still same issue.

TimW · Mar 12, 2015

This is something we haven't seen before. Let me consult with my colleagues.

Vako · Mar 12, 2015

Yes sir, Waiting.

Vako · Mar 12, 2015

http://prntscr.com/6g0exj heres a picture of ads and tab http://prntscr.com/6g0g8o

Vako · Mar 12, 2015

Nevermind, you can close topic. I deleted chrome and installed it again. Everything is fine.

TimW · Mar 13, 2015

Good to know.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Roll Around malware

Vako Private E-2

Attached Files:

RKreport_SCN_03122015_015802.log

tds.txt

HitmanPro_20150312_0156.log

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

Attached Files:

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

Vako Private E-2

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

Roll Around malware

Vako Private E-2

Attached Files:

RKreport_SCN_03122015_015802.log

tds.txt

HitmanPro_20150312_0156.log

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

Attached Files:

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Vako Private E-2

Vako Private E-2

Vako Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches