Deal4you and Adchoices Issues Logs Included

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Barz51, Jul 27, 2014.

  1. Barz51

    Barz51 Private E-2

    Hello All,
    You helped me out years ago with a nasty LOP infection and now I'm back for more! I'm helping my in-laws with their lap top which is almost unusable do the pop ups, hyperlinks, and redirects when on the internet. The pop ups I've seen all say Deal4me or Adchoices and both are terribly annoying. I've worked through the READ ME and I'll attach the logs. Thank you in advance for your help, you guys rock!
     

    Attached Files:

    Last edited: Jul 27, 2014
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Uninstall the below programs. If you do not find them or they will not uninstall, just keep going.
    Java 7 Update 60

    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
    explorer.exe
     
    :Files
    C:\Users\Breault\Documents\Optimizer Pro
    c:\progra~3\fastan~1
    C:\ProgramData\APN
    C:\ProgramData\ceb713a7d75c3076
    C:\ProgramData\deal4mE
    C:\Program Files (x86)\Common Files\Spigot
    C:\Windows\TEMP\*.*
    C:\Users\Breault\AppData\Local\Temp\*.*
    
    :Reg
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{1146AC44-2F03-4431-B4FD-889BC837521F}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{5F189DF5-2D05-472B-9091-84D9848AE48B}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{6791A2F3-FC80-475C-A002-C014AF797E9C}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\{77D46E27-0E41-4478-87A6-AABE6FBCF252}]
    [-HKEY_USERS\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
    [-HKEY_USERS\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}]
    [-HKEY_USERS\.DEFAULT\Software\AskPartnerNetwork]
    [-HKEY_USERS\S-1-5-18\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
    [-HKEY_USERS\S-1-5-18\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}]
    [-HKEY_USERS\S-1-5-18\Software\AskPartnerNetwork]
    [-HKEY_USERS\S-1-5-19\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}]
    [-HKEY_USERS\S-1-5-20\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}]
    [-HKEY_USERS\S-1-5-21-571250624-2267263903-3574193995-1001\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}]
    [-HKEY_USERS\S-1-5-21-571250624-2267263903-3574193995-1001\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}]
    [-HKEY_USERS\S-1-5-21-571250624-2267263903-3574193995-1001\Software\Optimizer Pro]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=""
    [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6604EF07-D723-4270-AEDE-2988A96D294F}]
    :Commands
    [purity]
    [EmptyTemp]
    [start explorer]
    [Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large [​IMG] button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXT log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  3. Barz51

    Barz51 Private E-2

    This is infuriating! I just got a new Surface Pro 3 from work and now it's showing the Adchoices hyperlinks! I've literally been to less than 30 sites and the vast majority I trust! Where does this crap come from? I've attached a screen shot of my history. Any suggestions would be helpful.

    I'll run the repairs on the laptop this morning, thank you for that as well.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    These are not problems. They are normal on many websites. They are a source of revenue which helps to keep websites running. Free forums like this cannot exist for free. They require revenue to pay for everything and AdChoices, IntelliText....etc are all ways to do this.

    These are not true popups in the sense of malware. They are context sensitive words that are underlined and when a mouse cursor moves over them they open up an advertisement. If you don't move your mouse over the words then you will not see the advertisement. While they can be annoying, they help you in the long run because as stated above, websites and forums like this would not be here to help you otherwise. At least not for free. ;)
     
    Last edited: Jul 30, 2014
  5. Barz51

    Barz51 Private E-2

    Well that's good to know! I really appreciate all the help!

    Still having some redirect issues and Deal4me stuff on the laptop. Here are the logs. Thanks again!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Which browser?



    Now let's dig a little further. Please download OTL by OldTimer.
    • Save it to your desktop.
    • Double-click on the OTL icon on your desktopto run it. (Note: if using Vista, Win7 or Win8 use right-click and select Run as Administrator)
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
      netsvcs
      drives
      
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
  7. Barz51

    Barz51 Private E-2

    Primarily, they are using Chrome. OTL created two logs so I attached them both. Thanks again!
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    There's nothing showing in these logs either. Check you shortcut links that you open up Chrome from to make sure they have not been modified. If you don't see anything in them then try the below.

    Reset Chrome to Defaults
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds