daughter's computer

lorioelfke · Jul 20, 2015

Daughter's laptop is likely infected by some adware/malware that I am working on fixing. I have completed all of the steps on "Fixing browser and search engine redirection/hijacking problems" without successfully eliminating the nuisance hijacking Google Chrome. I am now working on the Read & Run Me First: Malware Removal Guide and have run into an immediate problem. Step 3 asks me to open Control Panel and when I do, there is a problem. A screen shot is attached. I hope you'll be able to help me get past this stumbling block so I can move ahead with removing the malware.

lorioelfke · Jul 20, 2015

I realized later that you would like to see logs from "Fixing browser and search engine redirection/hijacking problems." Those logs are attached. TDSSkiller did not find any issues. I am also including the report from backing up the computer, showing some files that could not be found.

TimW · Jul 20, 2015

If you run into problems, let us know about it, but just keep going. We need the logs from RogueKiller, Hitman, and the MGTools.

lorioelfke · Jul 21, 2015

After running CCcleaner, I was able to access Control Panel and was able to turn off User Control.

Attached are requested logs.

I subscribe to Malwarebytes Premium and have included the two scans that were generated this morning. One is a threat scan and the other is what they call a protection scan.

Your file attacher would not allow me to upload the Rogue killer log that was created this morning, describing it as invalid. So I went into Rogue killer and created a text log, naming it Alternate Rogue killer log and attached it.

The other logs will come in another message!

Still Having issues with Google Chrome; a screenshot of what that issue looks like is attached as a jpeg.

Thanks for your help!

lorioelfke · Jul 21, 2015

MGTools log attached.

lorioelfke · Jul 21, 2015

The screen shot is too big to upload so I guess you'll have to let me know if you want any additional information about the Google Chrome problem.

TimW · Jul 21, 2015

Rerun Hitman and have it remove all items under>> Potential Unwanted Programs.

Now do this:
Reset Chrome to Defaults

Reboot and rescan with Hitman and attach a new log. Be sure to tell me how things are running now.

lorioelfke · Jul 21, 2015

I have just finished running Hitman Pro again, the first step in your assignment to me. I do not know which items are Potentially Unwanted Programs. Everything in the scan results is listed as AskBar, CouponBar, Softonic, or Unideals. Do I delete all of these? Scan is attached.

lorioelfke · Jul 21, 2015

I read the log and discovered that everything falls under the category of PUP so I'll proceed.

lorioelfke · Jul 21, 2015

Here's the final Hitman Pro log. The log keeps showing ask.com even though its been deleted in Hitman Pro twice now. Also there was a coupon bar that showed up in the results but did not show up in the log.

I opened 10 tabs in Google chrome and didn't have any hijacking trouble.

I've turned the antivirus protection back on.

Thanks for all of your help. Let me know if there's something else I should try.

TimW · Jul 21, 2015

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

lorioelfke · Jul 21, 2015

Here is the Junk Removal log.

TimW · Jul 21, 2015

You didn't tell me how things are running now.

lorioelfke · Jul 21, 2015

In response to your inquiry, I opened Google Chrome. Soundersfc.com worked fine in the first tab. I was in the midst of typing in youtube.com when the screen was taken over by a message that says "The page at https://solvemypc1.net says: 1) Windows Firewall Warning ***YOUR COMPUTER MAY HAVE ADWARE/SPYWARE VIRUS*** Call 1-866-377-1242 immediately for assistance on how to remove potential viruses. The call is toll free.

The message goes on to describe risks and more about the virus, ending with another plea to call the phone number above.

It was continually repeating messages such as these that prompted my visit to majorgeeks.com seeking assistance.

When these messages pop up, they seem to affect typing and also cause random skipping from one tab to another in the midst of typing.

I guess we are not out of the malware woods yet.

TimW · Jul 21, 2015

Uninstalll Google Chrome. Completely.
Uninstall Chrome but also delete these folders:
C:\Users\User Name\AppData\Local\Google\Chrome
C:\Program Files (x86)\Google\Chrome

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator

Click on the Scan button.

AdwCleaner will begin...be patient as the scan may take some time to complete.

After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).

The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.

Attach the logfile to your next next reply.

A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Reboot and reinstall Chrome. Now tell me how things are running.

lorioelfke · Jul 21, 2015

Google Chrome is uninstalled.

I cannot find either of the files that you requested to be deleted. When I type the second one into search, the MGlogs.zip file, and the JRT log pop up, but no individual file.

I'll await further direction before running AdwCleaner.

TimW · Jul 21, 2015

Go ahead and run ADW cleaner. Reboot and rescan with Hitman and attach the logs.

Reinstall Chrome and tell me if the problems still exist.

Are any other browsers affected?

lorioelfke · Jul 22, 2015

Here's the AdwCleaner log. I didn't delete anything yet because I feel rather unsure. I see some AVG files in there and my daughter has AVG antivirus protection on her computer. So I am stalled until I get some advice as to whether or not I should leave all those things in the list of what AdwCleaner says should be deleted.

TimW · Jul 22, 2015

Remove everything except these items:

File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
Folder Found : C:\Program Files (x86)\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\ProgramData\Avg_Update_0814tb
Folder Found : C:\Users\Elena\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Elena\AppData\LocalLow\AVG Secure Search
Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\Avg Secure Update
Key Found : [x64] HKCU\Software\AVG Secure Search
Key Found : [x64] HKCU\Software\Avg Secure Update
Key Found : HKLM\SOFTWARE\AVG Secure Search
Key Found : HKLM\SOFTWARE\Avg Secure Update
Key Found : HKLM\SOFTWARE\AVG Security Toolbar
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Found : HKU\.DEFAULT\Software\Avg Secure Update
Click to expand...

Reboot and rescan with Hitman. Attach the log and tell me how things are running.

lorioelfke · Jul 22, 2015

Okay to delete the following in AdwCleaner:

HKLM\SOFTWARE\Mozilla\Firefox\Extensions
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

TimW · Jul 22, 2015

All except the AVG secure search.

lorioelfke · Jul 22, 2015

Attached is a post-cleaning AdwCleaner log. I rebooted and then ran HitmanPro; log is attached. Google Chrome has been reinstalled. I opened about 20 different tabs in Google Chrome with no problem.

One thing that I noticed is that when Google Chrome opened after reinstallation, all of my daughters bookmarks were still there. Is that supposed to happen?

Thanks for your help. Let me know what I should do next.

TimW · Jul 22, 2015

Yes, they are still there because of the two files you could not find to delete.

It looks good.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

lorioelfke · Jul 23, 2015

Running the MGclean.bat file left two copies of MGlogs.zip on the computer. Should I leave these?

There is no uninstall available for TDSSKiller and AdwCleaner. I see those are both .exe files. Can I just delete them?

TimW · Jul 27, 2015

Yes, you can just delete those files.

daughter's computer

lorioelfke Private E-2

lorioelfke Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

Attached Files:

lorioelfke Private E-2

Attached Files:

lorioelfke Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

Attached Files:

lorioelfke Private E-2

lorioelfke Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

lorioelfke Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches