UTubeAdBloCk and Popups Out of Control!

thegunshow101

New Member
Thread author
Jul 20, 2014
6
Please Help,

My son's computer is infected with UTubeAdBloCk + other virus warning popups. Its out of control. It as subtle as product popups, or as destructive as taking over web pages, trying to force me to download updates to Java and etc.

I've installed a few programs.. but nothing more to this point..

I ran a FRST scan and attached the results..

I appreciate any assistance in this matter..

Thanks!
 

Attachments

  • FRST.txt
    55.2 KB · Views: 109

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hello,


Before we start please read and note the following:


icon_arrow.gif
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
icon_arrow.gif
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
icon_arrow.gif
Do not paste the logs in your posts, attachments make my work easier. There is a Upload a File button which you can use to attach your reports. Attach all reports.
icon_arrow.gif
Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
icon_arrow.gif
Note that we may live in totally different time zones, what may cause some delays between answers.
icon_arrow.gif
Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.

icon_idea.gif
I can't foresee everything, so if anything unexpected happens, please stop and inform me!
icon_idea.gif
There are no silly questions. Never be afraid to ask if in doubt!




I still need Addition.txt report.
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
FRST.gif
Fix with Farbar Recovery Scan Tool

icon_exclaim.gif
This fix was created for this user for use on that particular machine.
icon_exclaim.gif

icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on
    FRST.gif
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.




Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
  • Click on the Scan button.
  • After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Post logfile will also be saved in the C:\AdwCleaner folder.




520e76988454e-tdsskiller.PNG
Scan with TDSSKiller

Please download TDSSKiller by Kaspersky and save it to your desktop.

  • Right-click on
    520e76988454e-tdsskiller.PNG
    icon and select
    RunAsAdmin.jpg
    Run as Administrator to start the tool.
  • Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
  • Your machine may appear very slow and unusable after that - it's normal.
  • TDSSKiller will run automaticaly. Click on Change parameters and click OK.
  • Click the Start Scan button and wait patiently.

If anything will be found follow this guidelines:
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    If Cure is not available, please choose Skip instead.
  • Do not choose Delete unless instructed!

A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.




Things I need you to do and attach:
- Fixlog.txt
- Adwcleaner report
- TDSS Killer report
 

Attachments

  • fixlist.txt
    6.1 KB · Views: 82

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
It seems you have more serious virus than I thought, or this could be something else. We will now have to work outside Windows in order to fix this:


Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.
  • Plug the flashdrive into the infected PC.
  • Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
  • Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.
In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.
  • In the command window type in notepad and press Enter.
  • When notepad opens, click File and select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst64.exe and press Enter.
Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run. When the tool opens click Yes to disclaimer.
  • Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.
 
Last edited:

thegunshow101

New Member
Thread author
Jul 20, 2014
6
I have Frst on a usb key.. however as soon as I hit f8.. it just brings me back to the same screen that I sent you in the screenshot (immediately).. Its just a cycle and I can't get into an 'advanced menu' to choose repair..
 

thegunshow101

New Member
Thread author
Jul 20, 2014
6
No F8 works.. but not as desired.. It immediately dumps me back into the same error screen as my screenshot..

I'm kind of stuck.. I'm back at my office now though.. I have the windows installer. Should I do a 'repair computer"?.. and, if I do this what is this going to do to my current install/data/programs.. etc?

Or do you have a better idea?

Thanks in advance..
 

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Please download the following tools on your Desktop:
  1. Farbar Recovery Scan Tool x64
  2. Rufus
  3. Windows 7 RC x64

  • Insert your USB and then start Rufus
  • Select the ISO file win7 64bit rc.iso on the desktop via the ISO icon.

16kbazl.jpg


  • Under the Device select your USB Flash.
  • Press Start
  • When the process is complete, copy Farbar Recovery Scan Tool x64 on this USB
  • Insert USB into infected computer and power on the computer. Now you need to set your computer to boot from USB. In order to do that, follow this guide.
  • When you boot from USB, you will see image like this:
2mo49iw.jpg


  • Click Repair your computer
  • Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.
In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.
  • In the command window type in notepad and press Enter.
  • When notepad opens, click File and select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst64.exe and press Enter.
Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run. When the tool opens click Yes to disclaimer.
  • Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top