Solved Help ad.directrev.com maleware

[Transam98]

Ive ran ADW Cleaner (newest of all programs)
comes back clean

then I ran JRT also comes back clean (JRT.txt has ZERO and ZERO)

ive ran hitman pro (registered)(comes back clean nothing...)

Ive ran spyhunter.. all clean there

Ive done a chrome reset

When I goto a page and right click open in new tab (a link)... a additional tab comes up TRYING to goto ad.direct* (luckily for my my ROUTER blocks it) but the TAB still opens...

I cant find the ad.direct* anywhere (but this is the TAB and the ROUTER is telling me that is where it WAS trying to go before the router BLOCKED the evil BUG .....)

Can anyone suggest another way I might be able to find his pesky malware ? and kill it for once ?

Ive followed the guide here : to a T... Remove Ad.directrev.com pop-up ads (Virus Removal Guide)

 

[Transam98]

small update: Ive also ran MBAM and now Roguekiller (x64) (RK has found 1 thing..SECOH-QAD.exe)

 

[TwinHeadedEagle]

Hello,


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
  
  
  
  
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[Transam98]

ok (after removing that above file..).. it didnt fix the ad.direc*...

I downloaded FRST and have uploaded both the FRST and Addition Thanks for taking the time to take a look and letting me know ... I DID click FIX on what FRST found... and will report in my next message as to if it got rid of the additional tab trying to goto ad.direct*

in looking at the logs weird things i noticed... a few say ATTENTION, I dont have ACRONIS True Image installed anymore and a thing called REGISTRY Revivor....(maybe stuff leftover) ?

 

[Transam98]

2 other things ... I DID disable utorrent (when I ran the FRST tool) and also attached is the screen shot of the "additional" tab that opens (like I said fortunately my router's software auto blocks it) so ive never technically been to the ad.dir* site thank god thx

 

[TwinHeadedEagle]

Yes, there are some remnants we will clean-up. Is this warning happening on all websites and/or in all web browsers?

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Transam98]

Yes, there are some remnants we will clean-up. Is this warning happening on all websites and/or in all web browsers?

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Transam98]

Ill Try it now and post a reply with the attached file, then Ill REBOOT after all is done.(and try) I havent tried to see if the (as im assuming malware) is in IE or FFox (as I really dont use them unless there is a emergency and chrome isnt working....)

Ive only noticed it on a few websites, and mostly when Ill DL a file from like usercloud or rapidgator or file repository/storage sites.

 

[Transam98]

Ill Try it now and post a reply with the attached file, then Ill REBOOT after all is done.(and try) I havent tried to see if the (as im assuming malware) is in IE or FFox (as I really dont use them unless there is a emergency and chrome isnt working....)

Ive only noticed it on a few websites, and mostly when Ill DL a file from like usercloud or rapidgator or file repository/storage sites.

Ok ive ran the FRST with that fixlist.txt, I saw it deleted a lot of temp files etc etc.. then I let it reboot and tried it... same thing ;( still got that malware somewhere ;(...

small sidenote i saw log entries (in my addition.txt etc) of VMWARE... I uninstalled that LONg ago, but this infection of ad.direct* is Id say maybe in the last 1-2 weeks max.

Log you requested attached

 

[TwinHeadedEagle]

Your PC seems clean. If it is happening on only on a few websites, then it is related to them. You can try Adblock: AdBlock

 

[Transam98]

Thanks for all of your help ! It may be clean, It does make sense that it could be just the few websites, as I see it happen on NO OTHER ones and I look at a lot daily ! Again thanks for taking the time to make that custom TXT file to rid my system of *crap* and leftover turds And ill also add the ad.direct* to my ABP (Ad blocker plus) as a secondary precaution