ElectricSheep's new config

[ElectricSheep]

Think I've finally cleaned system up but not 100% sure as I got a mega infection a month ago (Drunk downloading) *No need to tell me, I learned my lesson - never again* MBAM came up with... yes wait for it... 1,200 examples of crud like Trojans, etc. A month later, think I've finally cleaned it all up thanks to all the useful guides on this site, but how can I be sure?

 

[Cowpipe]

One of us can check your computer over for you if you like?

If you can download FRST from here and save it to your Desktop. Then open the tool and press the Scan button. You'll then find two log files on your desktop, called FRST.txt and Addition.txt if you could reply back to this thread with both of those files attached using the "Upload a File" button (next to "Post Reply"), I will check everything over and if necessary give you further instructions on cleaning up your computer

------
Edit: I would recommend dumping Adblock Plus for uBlock which is much lighter on your system and faster Other than that, your setup looks good, although I'm not sure you need so many different on demand scanners And as Illumination points out below, having a backup solution is a must. If you don't use backup software, do as I do and copy your files onto CDs, DVDs or some kind of once-writeable media for permanent backup.

 

[illumination]

With back up and recovery, having personal files, is not the only reason to back up your system. Hardware failure can and does happen, corruption can and does happen. Backing up the Operating System is a fail safe that will save you when all else fails.

 

[ElectricSheep]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran on 02-09-2014 18:10:05
Running from C:\Users\Downloads
Platform: Windows 8.1 (X64) OS Language: English (United Kingdom)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

[Aura]

I'm not sure that this is the right section to get a check-up ? Also, only approved helpers are allowed to give malware removal assistance no ?
Did you try white-listed the AdwCleaner file and process on Norton 360 or temporary disable it when you run it ? Also, submit AdwCleaner as a false positive to Norton, because it is and it always happens.

 

[ElectricSheep]

I did supply the AdwCleaner to Symantec as false positive

 

[Aura]

I did supply the AdwCleaner to Symantec as false positive

Guess you'll have to do that everytime Xplode releases a new version of AdwCleaner.
Did you try white-listing it yet ?

 

[ElectricSheep]

How do you white-list that?

 

[Aura]

How do you white-list that?

Google is your friend buddy :

http://community.norton.com/t5/Norton-360/How-to-add-folder-to-exceptions/td-p/726674

That should do the trick, seeing as it's called a "Real-time exclusion", so I guess that the file will also be white-listed on Runtime.

 

[Cowpipe]

Hi, you do have some remnants of an infection in your log. Whilst I am independently qualified to remove malware, it is the job and task of our official malware remover to do so. To avoid risking breaking the rules here I won't issue you a Fixlog but I will make sure your post gets moved to the Malware Removal section, where our resident malware remover will guide you through removing the malware.

 

[ElectricSheep]

Tried getting hold of the AdwCleaner, keeps saying file could not be found. When I try renaming the file, says it's corrupted or unreadable

 

[ElectricSheep]

Hi, you do have some remnants of an infection in your log. Whilst I am independently qualified to remove malware, it is the job and task of our official malware remover to do so. To avoid risking breaking the rules here I won't issue you a Fixlog but I will make sure your post gets moved to the Malware Removal section, where our resident malware remover will guide you through removing the malware.

OK cheers, just as I suspected... remnants hiding in there

 

[Aura]

Tried getting hold of the AdwCleaner, keeps saying file could not be found. When I try renaming the file, says it's corrupted or unreadable

I would try disabling Norton, download AdwCleaner, whiste-list it and then enable it.

 

[Cowpipe]

OK cheers, just as I suspected... remnants hiding in there

Nothing serious and it's an easy fix but like I say, I don't want to be in breach of the rules here I'll check up on this and if you don't have it sorted in a couple of days I'll make sure it gets dealt with for you asap

 

[ElectricSheep]

Thanks Aura, got the AdwCleaner up n running. (AV still trying to kill it, lol)
***** [ Files / Folders ] *****

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk
And this:
***** [ Files / Folders ] *****

Folder Deleted : C:\Users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Weather Alerts
Folder Deleted : C:\Users\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
That Weather Alerts was an awkward one to shift, ended up using Revo to kill it when I first got the infection (noticed that one immediately)
And this also:
***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Also had Astromenda. Shoot the guy that created it!

 

[Aura]

Good job with AdwCleaner.
Let's see what your thread in the malware removal section will give.

 

[Exterminator]

Some type of back up.Thanks for sharing your config

For Malware assistance go here http://malwaretips.com/forums/malware-removal-assistance.10/

 

[ElectricSheep]

Some type of back up.Thanks for sharing your config

For Malware assistance go here http://malwaretips.com/forums/malware-removal-assistance.10/

Yeah, I'll start looking into some form of back up. Windows 8 is pre-installed.

 

[NSG001]

All lookin' good now
Hope you get the dregs cleaned out soon!

 

[ElectricSheep]

copying this lot (logs) into the removal forum, lets see what happens