Solved Can't remove Obrona

[Ed_M1]

OK. I read it. What did I do wrong?

 

[Ed_M1]

i reread it. What one of the rules did I break?

 

[argus]

Download attached fixlist.txt file and save it to the Desktop:
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!
Run FRST.exe
Press the Fix button just once and wait.
When finished FRST will generate a log on the Desktop, called Fixlog.txt.


Please attach it to your reply.

 

[Ed_M1]

Log After running FIX:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-02-2015
Ran by emowrey1 at 2015-02-03 14:25:10 Run:1
Running from C:\Users\emowrey1\Downloads
Loaded Profiles: emowrey1 (Available profiles: emowrey1 & Administrator)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
closeprocesses:
emptytemp:
HKU\S-1-5-21-4150287182-2758880135-4216909146-1001\...\Run: [Obrona Block Ads] => C:\Users\emowrey1\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe [1509336 2014-10-16] (RedSky Sp. z o.o.)
C:\Users\emowrey1\AppData\Local\Obrona Block Ads
SearchScopes: HKLM -> DefaultScope {36CCD620-C670-435D-A0D0-C4BB88D34C7F} URL = http://start.mysearchdial.com/resul...GtB0BtAyBtC0DyCyC0CyE0EtD2Q&cr=1298699287&ir=
SearchScopes: HKLM -> {36CCD620-C670-435D-A0D0-C4BB88D34C7F} URL = http://start.mysearchdial.com/resul...GtB0BtAyBtC0DyCyC0CyE0EtD2Q&cr=1298699287&ir=
CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - No Path
CHR HKLM-x32\...\Chrome\Extension: [fmgckcapmffomaifonnhgkfdgljnkpgi] - No Path
CHR HKLM-x32\...\Chrome\Extension: [ohhcpmplhhiiaoiddkfboafbhiknefdf] - No Path

*****************

Processes closed successfully.
HKU\S-1-5-21-4150287182-2758880135-4216909146-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Obrona Block Ads => value deleted successfully.
C:\Users\emowrey1\AppData\Local\Obrona Block Ads => Moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{36CCD620-C670-435D-A0D0-C4BB88D34C7F}" => Key deleted successfully.
HKCR\CLSID\{36CCD620-C670-435D-A0D0-C4BB88D34C7F} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\fmgckcapmffomaifonnhgkfdgljnkpgi" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ohhcpmplhhiiaoiddkfboafbhiknefdf" => Key deleted successfully.
EmptyTemp: => Removed 1.3 GB temporary data.


The system needed a reboot.

==== End of Fixlog 14:25:54 ====

 

[argus]

Very good, how is the situation now?

 

[Ed_M1]

Very good, how is the situation now?

Done. Rebooted.
At first performance better.
Able to access internet.
"Obrona Block Ads" is still found when I search "Obrona".

When I accessed internet,
Got bunches of pop-ups saying I needed new media software, saying "urgent security breach" etc.
Performance slowing!

I'm now using my old computer to reply because the one we're trying to fix wouldn't let me.

 

[argus]

Download

Malwarebytes Anti-Rootkit to your desktop.

• Double-click the icon to start the tool.
• It will ask you where to extract it, then it will start.
• Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
• Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".
• When the scan is finished and no malware has been found select "Exit".
• If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
• Open the MBAR folder and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"

 

[Ed_M1]

Download

Malwarebytes Anti-Rootkit to your desktop.

• Double-click the icon to start the tool.
• It will ask you where to extract it, then it will start.
• Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
• Click in the introduction screen "next" to continue.
• Click in the following screen "Update" to obtain the latest malware definitions.
• Once the update is complete select "Next" and click "Scan".
• When the scan is finished and no malware has been found select "Exit".
• If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
• Open the MBAR folder and paste the content of the following files in your next reply:
  • "mbar-log-{date} (xx-xx-xx).txt"
  • "system-log.txt"

I don't know how to "run from an account with administrator rights".
When I download anti-rootkit it prompts me to save the file, but doesn't tell me where it saves it, and I can't find it to execute it

 

[argus]

Right click on mbar, Run as Administrator

 

[Ed_M1]

I went to my old computer, downloaded it, ported it on a thumb drive to my new laptop.

Ran it. It made a folder on my desktop.

What next?

 

[Ed_M1]

Tried to access internet again. Get lots of re-directs, one after another. No good.
Also get message "unresponsive script"

 

[argus]

I went to my old computer, downloaded it, ported it on a thumb drive to my new laptop.

Ran it. It made a folder on my desktop.

What next?

Run as Administrator

 

[Ed_M1]

I ran it successfully. There's now a folder for it on my desktop. What do I do next?

Bad: Not able to access internet. everything re-directed to warningalertmessage.com

Still getting pop-ups saying "Please update to MediaDownloader..."

 

[argus]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

 

[Ed_M1]

Repeating FRST--can I use the version downloaded previously?

If not, please send URL's for the exe files. I have to get the URL from you on my old computer, and then copy them to a thumb drive, and from there to the computer we're working on.

 

[argus]

Yes.

 

[Ed_M1]

Yes.

Please send URL for AdwCleaner


Ran FRST. Here's the fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-02-2015
Ran by emowrey1 at 2015-02-03 18:24:41 Run:2
Running from C:\Users\emowrey1\Downloads
Loaded Profiles: emowrey1 (Available profiles: emowrey1 & Administrator)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
closeprocesses:
emptytemp:
HKU\S-1-5-21-4150287182-2758880135-4216909146-1001\...\Run: [Obrona Block Ads] => C:\Users\emowrey1\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe [1509336 2014-10-16] (RedSky Sp. z o.o.)
C:\Users\emowrey1\AppData\Local\Obrona Block Ads
SearchScopes: HKLM -> DefaultScope {36CCD620-C670-435D-A0D0-C4BB88D34C7F} URL = http://start.mysearchdial.com/resul...GtB0BtAyBtC0DyCyC0CyE0EtD2Q&cr=1298699287&ir=
SearchScopes: HKLM -> {36CCD620-C670-435D-A0D0-C4BB88D34C7F} URL = http://start.mysearchdial.com/resul...GtB0BtAyBtC0DyCyC0CyE0EtD2Q&cr=1298699287&ir=
CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - No Path
CHR HKLM-x32\...\Chrome\Extension: [fmgckcapmffomaifonnhgkfdgljnkpgi] - No Path
CHR HKLM-x32\...\Chrome\Extension: [ohhcpmplhhiiaoiddkfboafbhiknefdf] - No Path

*****************

Processes closed successfully.
HKU\S-1-5-21-4150287182-2758880135-4216909146-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Obrona Block Ads => Value not found.
C:\Users\emowrey1\AppData\Local\Obrona Block Ads => Moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{36CCD620-C670-435D-A0D0-C4BB88D34C7F} => Key not found.
HKCR\CLSID\{36CCD620-C670-435D-A0D0-C4BB88D34C7F} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee => Key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\fmgckcapmffomaifonnhgkfdgljnkpgi => Key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ohhcpmplhhiiaoiddkfboafbhiknefdf => Key not found.
EmptyTemp: => Removed 163.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog 18:24:52 ====

 

[argus]

http://www.bleepingcomputer.com/download/adwcleaner/dl/125/

 

[Ed_M1]

I can't download it because I keep getting the message "Proxy server is refusing connections". Happens in Firefox, IE, and Chrome, no matter what I try to do--no internet connection, but my cable is not down. Other things work.

 

[argus]

http://malwaretips.com/blogs/the-proxy-server-is-refusing-connections-removal/#adwcleaner

Look here