cannot remove lpcloudsvr302

[Zimboombafoo]

I started getting lpcloudsvr.302 popups around 2-3 months ago on firefox.

I switched to google chrome months ago after getting these popups because I couldn't seem to remove it, I forgot about until I reinstalled firefox. I reinstalled firefox today and the popups have begun once again.

I tried to scan for it when it first showed up but today I followed the guide you have on this website (used malwarebytes, JRT, adwcleaner) but I'm still getting the popup. Also, it has never shown up in my list of programs I can uninstall, so I was never able to "uninstall" it.

 

[TwinHeadedEagle]

Follow this topic and attach requested reports --> http://malwaretips.com/threads/malware-removal-assistance-how-to-get-help.20334/

 

[Zimboombafoo]

Thanks so much for your help, here you are. I notice there are a variety of strange things on the Addition file (with over 1000 more lines not listed, as it says) listed under Hosts. I went into hosts earlier today and those appear to be under Spybot S&D. I think they are files that I am immunized against (by running immunization on Spybot), maybe I'm wrong.

 

[Zimboombafoo]

and here is the aswMBR log

 

[TwinHeadedEagle]

Ok, before we begin I think Spybot is outdated product and is not capable to fight with latest infections. MalwareBytes is much better product to use today.

Also, please go to Control Panel and uninstall:
- Advanced System Care --> totally unneeded program, this is just blowing smoke and something potentially dangerous
- IOBIT apps --> they have not very good past, some of them even included stealing other apps property

I highly recommend you to uninstall them and it is up to you to decide.



Please download zoek.zip or zoek.rar by smeenk (

) from here or here and save it to your Desktop.
Unpack the archive...

• Close any open browsers
• Temporarily disable your AntiVirus program. (If necessary)
  If you are unsure how to do this please read this or this Instruction.
  
• Double click on zoek.exe to run the tool .
  Please wait while the tool does not start...
  
• Copy the text present inside the code box below and paste it into the large window in the zoek tool:
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
  
  

  createsrpoint;
  gpt.ini;z 
  C:\Windows\System32\GroupPolicy;v
  C:\Windows\SysWOW64\GroupPolicy;v 
  StandardSearch; 
  emptyfolderscheck; 
  installer-list; 
  installedprogs; 
  uninstall-list;

• Click on
  
  button.
  Please wait until a logreport will open (this can be after reboot)
  
• Save notepad to your Desktop and attach here zoek-results.log
  Note: It will also create a log in the C:\ directory named "zoek-results.log"

 

[Zimboombafoo]

it's telling me that zoek is a malicious file when i go to download it..

 

[TwinHeadedEagle]

No, it is not. Disable you Antivirus and try again. Or try another browser.

 

[Zimboombafoo]

okay now it's telling me (after i downloaded the folder and extracted the files) that "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item." My antivirus was disabled when I tried it. For some reason after trying to open them they vanished from the folder entirely.

 

[TwinHeadedEagle]

1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
Note: ComboFix must be downloaded to your Desktop.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!

- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.

 

[Zimboombafoo]

here you are

 

[TwinHeadedEagle]

Is it better not? Can you now try to run Zoek?

 

[Zimboombafoo]

It let me run zoek now yes, here's the log.

 

[TwinHeadedEagle]

Look good, is problem still out there?

 

[Zimboombafoo]

I haven't encountered it so far today, thank you. Which program removed whatever was causing the problem?

 

[TwinHeadedEagle]

ComboFix removed some suspicous files. If everything is ok, and you do not have more questions, we're done here



• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

 

[Zimboombafoo]

Great, thank you so much for your help - I appreciate it immensely.