Solved Obrona VPN Deals Help

[blm1987]

Hello,

I have an issue with Obrona VPN Deals malware. I have ran the Malwarebytes Anti-Rootkit, and have attached the log files. After the Malwarebytes scan I restarted my system and scanned with the Farbar recovery tool. The log files from that scan are attached as well.

I thank you in advance for your assistance.

 

[argus]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

 

[blm1987]

I ran the Farbar fix and it generated this error. I have attached the fixlog file.

 

[argus]

Download new version
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

 

[argus]

Sorry here new Fixlist

 

[blm1987]

Unfortunately I receive the same error after re-installing the FRST tool and using the new fixlist. THe new fixlog is attached

 

[argus]

emtytemp:
emptytemp:

It's a mistake.

Run again fix, sorry, now corrected.

 

[argus]

You have FRST old version folder?

 

[blm1987]

I deleted all versions of FRST and the fixlist and ran the Fix. It ran for a while, but eventually the same error occured. It did make some changes, my browser history was empty, but I still see the pop-up ads and videos. The fixlog from the most recent scan is attached. The product version of FRST I am using is 3.3.12.0.

 

[argus]

Run again fix

 

[blm1987]

Looks like that worked

 

[argus]

Cheers


Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.