FREAKING OUT!! FlashUpdate Virus keeps going and going and going...

[lala3369]

Hi there, this is my first post and I am new to this site so please bear with me. I am at the library using the computer because mine is so messed up.

Yes I am an idiot an opened an attachment that released this horrible, horrible replicating virus!!! It is an updateflash/send report to Microsoft pop up that just keeps opening new paths apps of ie and chrome!! I can barely access the net and just left my house in tears to come use computer at the library. Malewarebytes, CCleaner either recognize but don't remove or don't see it at all. I cannot find it in control panel to uninstall although I have followed path to file and the folder seems to be growing exponentially!!! I did run AdwCleaner but I cannot find the download on my computer. I have no icon and does not show up in programs/files! I will come back after I get home and try to access this site and attach logs- PLEASE PLEASE HELP!! I am a mediocre computer user however this is WAY out of my league!! I really need step by step instructions-thanks so much

 

[TwinHeadedEagle]

Hi,

Before we begin, I want you to have this in mind:

• At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process.
• Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  
• All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
• If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
• I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
  
• Please attach all report using
  
  button below. Doing this, you make it easier for me to analyze and fix your problem.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

[lala3369]

Oh wow I have tried to respond 2 times with logs and my computer is rejecting every attempt to do so!! Here we go again and ty! Let me tell you that I downloaded Farbar did first scan and somehow lost the FRST document-so the document newest is actually the 2nd scan-during all this my computer keeps freezing and the pop up boxesa are going crazy-please advise and tyty

 

[lala3369]

Ha that is crazy cus I only attached 2 documents but it looks like my previous attempts to reply and attach logs went through.....I am trying to follow you step by step-please bear with me and this horribly infected computer..

 

[TwinHeadedEagle]

I am currently away from home, will respond within 2 hours.

 

[TwinHeadedEagle]

First, go to Control Panel and uninstall following (skip lines that cannot be uninstalled):
- Catalina Savings Printer
- CouponPrinterPlugin

***** NEXT *****​

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Open FRST, and click Fix. Attach me that report after it is finished.

***** NEXT *****​

1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
Note: ComboFix must be downloaded to your Desktop.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!

- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.

 

[lala3369]

Ok just FYI after restarting my comp after fix random web search engines popping up in window like Microsoft-go and Bing...still getting system tray messages...just for FYI not expecting fix so soon!! Ok attached is the post-fixlist log

 

[lala3369]

Ok this is crazy-but for a while I couldnt upload file and then I kept being told that I wasn't connected to a network ummmm I am running combo now and will attach log shortly...

 

[lala3369]

Ok here it is...also just got a pop up asking me to allow windows from microsoft to open...crazy

 

[TwinHeadedEagle]

Open notepad and copy/paste the text present inside the code box below:
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Folder::
c:\users\lala3369\AppData\Roaming\Hiwarivy
c:\users\lala3369\AppData\Roaming\Kukeuva

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ovawebtuibnirep"=-
"Kebyuvu"=-

Driver::
bgzdxpbu

ClearJavaCache::

Save this as CFScript.txt

Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )

 

[lala3369]

thank You again here is the newest log

 

[TwinHeadedEagle]

How is computer now?

 

[lala3369]

Um it seems a little better-except I can't pull up my synaptics settings, search is now MSN, can't open some windows after double clicking, umm keep getting message box that says you are attempting to access a site off of secured network um only 2 iexplore 32* processes running and 2 iexplorer running (2 windows open) but no more flash pop ups!

 

[lala3369]

I will be out for a while but will check back in as I can today....wow ty I am finally feeling better about my computer

 

[lala3369]

I will be out for a while but will check back in as I can today....wow ty I am finally feeling better about my computer

hey when it prompts me by saying "you are about to leave a secure connection-should I click OK?

 

[TwinHeadedEagle]

You using Internet Explorer or other browser?

 

[TwinHeadedEagle]

open IE and go to Tools>Internet Options>Advanced tab.
Under the Security section UNcheck the box next to:
"Warn if changing between secure and not secure mode."

Ok out and close IE. Then open it and see if that resolves the problem.

 

[lala3369]

Hey I am using IE and I used the fix above looks OK now-Computer is running pretty slow-but definately better than what is was!! No crazy pop-ups-Are there more steps?

 

[lala3369]

Hey I am using IE and I used the fix above looks OK now-Computer is running pretty slow-but definately better than what is was!! No crazy pop-ups-Are there more steps?

Also can I go to synaptics site and update my driver to use my touchpad?
Thanks Again

 

[TwinHeadedEagle]

Can you re-run FRST once more, check Addition.txt, press Scan and attach both reports.