Solved Adware keeps coming back after being deleted

[elevandria]

The adware wants to redirect to ourluckysites.com. After a bunch of effort to purge it, it no longer seems to do changes to my browser, but it still install itself to my laptop everytime i try to remove it. The interval between the adware reinstalling itself seemed random. I usually use roguekiller to remove the adware everytime it comes back. It usually install files named ckafege_ and MIO to program files(x86) and an application named kitty though i'm not sure where it's located. It also used to say something like "snarer.dll cannot be found everytime" it crashes google chrome, though it no longer did that and i don't know why it doesn't show that anymore. Please bare with me here as i'm not an expert on computer and i'm new in this forum. thanks for your help.

 

[TwinHeadedEagle]

Hello,


Please download Zemana AntiMalware and save it to your Desktop.

• Install the program and once the installation is complete it will start automatically.
• Without changing any options, press Scan to begin.
• After the short scan is finished, if threats are detected press Next to remove them.

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.​

• Open Zemana AntiMalware again.
• Click on
  
  icon and double click the latest report.
• Now click File > Save As and choose your Desktop before pressing Save.
• The only left thing is to attach saved report in your next message.

 

[elevandria]

there you go

 

[elevandria]

there you go

 

[TwinHeadedEagle]

Please run tools from Normal mode. Sorry, that message wasn't for you.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your Desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now.
• After reboot, logfile will be opened. Copy its content into your next reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked.
  
  
  
  
  
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

 

[elevandria]

# AdwCleaner v6.046 - Logfile created 03/05/2017 at 21:55:58
# Updated on 24/04/2017 by Malwarebytes
# Database : 2017-05-02.1 [Server]
# Operating System : Windows 10 Home Single Language (X64)
# Username : Marvelous A.J - REIN
# Running from : D:\adwcleaner_6.046.exe
# Mode: Clean
# Support : Customer Support & Help Center



***** [ Services ] *****

[-] Service deleted: SpyHunter 4 Service
[-] Service deleted: esgiguard


***** [ Folders ] *****

[-] Folder deleted: C:\Users\Marvelous A.J\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\spyhunter
[-] Folder deleted: C:\Users\Marvelous A.J\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
[-] Folder deleted: C:\sh4ldr
[-] Folder deleted: C:\Program Files (x86)\Enigma Software Group
[-] Folder deleted: C:\WINDOWS\Update\psgo


***** [ Files ] *****

[-] File deleted: C:\Users\Marvelous A.J\Desktop\SpyHunter.lnk
[-] File deleted: C:\WINDOWS\SysNative\log\iSafeKrnlCall.log
[-] File deleted: C:\END
[-] File deleted: C:\spyhunter.fix
[-] File deleted: C:\WINDOWS\SysWOW64\kz.exe
[-] File deleted: C:\Users\Public\Documents\temp.dat
[-] File deleted: C:\Users\Public\Documents\report.dat
[-] File deleted: C:\Users\Marvelous A.J\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage
[-] File deleted: C:\Users\Marvelous A.J\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage-journal
[#] File deleted: C:\Users\Marvelous A.J\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage
[#] File deleted: C:\Users\Marvelous A.J\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\hxxp_st.chatango.com_0.localstorage-journal


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****

[-] Task deleted: SpyHunter4Startup
[-] Task deleted: Milimili


***** [ Registry ] *****

[-] Key deleted: HKU\.DEFAULT\Software\UpgSvr
[-] Key deleted: HKU\S-1-5-21-3624755597-3157177985-3930298230-1002\Software\PopWnd
[-] Key deleted: HKU\S-1-5-21-3624755597-3157177985-3930298230-1002\Software\UpgSvr
[#] Key deleted on reboot: HKU\S-1-5-18\Software\UpgSvr
[#] Key deleted on reboot: HKCU\Software\PopWnd
[#] Key deleted on reboot: HKCU\Software\UpgSvr
[-] Key deleted: HKLM\SOFTWARE\ScreenShot
[-] Key deleted: HKLM\SOFTWARE\EnigmaSoftwareGroup
[-] Key deleted: HKLM\SOFTWARE\msServer
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}
[#] Key deleted on reboot: [x64] HKCU\Software\PopWnd
[#] Key deleted on reboot: [x64] HKCU\Software\UpgSvr
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7BD8146798CEA704D860BE01414B8E51
[-] Value deleted: HKU\S-1-5-21-3624755597-3157177985-3930298230-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [Yeaplayer]
[-] Value deleted: HKU\S-1-5-21-3624755597-3157177985-3930298230-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [msiql]

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[elevandria]

done. sorry for the late reply

 

[TwinHeadedEagle]

How is your computer behaving now?

 

[elevandria]

the adware hasn't comeback yet. I'll see for a couple week and report back. Thanks for your help