Solved Multiple infections that will not go away

[JaydenS]

I am not sure when it started, but these viruses have been pestering my computer for awhile, and i have tried all of the removal guides for them that i could find, and they always seem to come back after a restart. Would much appreciate it if someone were to be of assistance.

 

[TwinHeadedEagle]

Hello,


Before we start please read and note the following:

Limit your internet access to posting here, some infections just wait to steal typed-in passwords.

Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.

Do not paste the logs in your posts, attachments make my work easier. There is a Upload a File button which you can use to attach your reports. Attach all reports.

Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.

Note that we may live in totally different time zones, what may cause some delays between answers.

Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  process;
  services-list;
  installedprogs;
  systemspecs;
  startupall;
  filesrcm;
  firefoxlook;
  chromelook;
  skipfix-iedefaults;

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Attach report into your next reply.

 

[JaydenS]

Took awhile for it to scan, but heres the results

 

[TwinHeadedEagle]

Scan with ZOEK

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  CltMngSvc;s
  C:\PROGRA~2\SearchProtect;fs
  C:\PROGRA~2\fst_us_139;fs
  C:\PROGRA~2\predm;fs
  C:\PROGRA~2\SearchProtect;fs
  C:\Users\Jayden\AppData\Local\fst_us_139;fs
  C:\Users\Jayden\AppData\Local\DynamicPricer;fs
  C:\Users\Jayden\AppData\Local\SearchProtect;fs
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FrEeSoFtOdAy;fs
  C:\ProgramData\RzMaelstromVAD_1.1.58.1854;fs
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run];r
  "fst_us_139"=-;r
  C:\Program Files (x86)\fst_us_139;fs
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows];r
  "AppInit_DLLs"="";r
  bkajpgajpbooodcjmpjakcoicbdidlgi;chr
  emptyalltemp;
  autoclean;

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.




Tell me how is computer after this?

 

[JaydenS]

I appreciate it, this seems to have cleared up almost everything. Though, something new has popped up called Browser Warden, should i just uninstall that using Uninstall a program?
As well as the problem with random pages being opened up when i click anywhere in my browser. Also, here is the file;

 

[TwinHeadedEagle]

This is not the correct report you attached.


I would like to perform one more deeper check:

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach them into your next reply.

 

[JaydenS]

Apologies for that, they were similarly named, and i presumed the newest would be the one with a different name. Here are the files i got from Farbar:
(As well as the correct file from Zoek)

 

[TwinHeadedEagle]

First, go to Control Panel and uninstall following (skip lines that cannot be uninstalled):
- fst_us_139
- IdleCrawler

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.




Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Tell me how is computer after this?

 

[JaydenS]

Restarted after doing everything you listed, seems to be running fine now! I appreciate your help very much! Also, here are the files

 

[TwinHeadedEagle]

Okay, then we're done here



Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing.

Recommended reading:
​

MUST READ - security tips: Computer Security - a short guide to staying safer online. Simple and easy ways to keep your computer safe and secure on the Internet

MUST READ - general maintenance: What to do if your Computer is running slowly?

Recommended additional software:
​

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

CryptoPrevent - to secure yourself from very severe CryptoLocker infection.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.


• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.



Stay safe,
TwinHeadedEagle