UTubeAdBloCk and Popups Out of Control!

[thegunshow101]

Please Help,

My son's computer is infected with UTubeAdBloCk + other virus warning popups. Its out of control. It as subtle as product popups, or as destructive as taking over web pages, trying to force me to download updates to Java and etc.

I've installed a few programs.. but nothing more to this point..

I ran a FRST scan and attached the results..

I appreciate any assistance in this matter..

Thanks!

 

[TwinHeadedEagle]

Hello,


Before we start please read and note the following:

Limit your internet access to posting here, some infections just wait to steal typed-in passwords.

Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.

Do not paste the logs in your posts, attachments make my work easier. There is a Upload a File button which you can use to attach your reports. Attach all reports.

Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.

Note that we may live in totally different time zones, what may cause some delays between answers.

Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!




I still need Addition.txt report.

 

[thegunshow101]

Thanks.. here you go!

 

[TwinHeadedEagle]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.




Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Scan with TDSSKiller

Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
  
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Click the Start Scan button and wait patiently.

If anything will be found follow this guidelines:

• If a suspicious object is detected, the default action will be Skip, click on Continue.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  If Cure is not available, please choose Skip instead.
• Do not choose Delete unless instructed!

A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.




Things I need you to do and attach:
- Fixlog.txt
- Adwcleaner report
- TDSS Killer report

 

[thegunshow101]

ohoh.. i did the fix .. it required a restart, but now I can't boot into windows. F8 isn't doing anything.. and I don't have the windows install with me (at the office).. Thoughts?

https://www.dropbox.com/s/lvbim1isgf4qfqg/2014-07-20 16.31.10.jpg

 

[TwinHeadedEagle]

It seems you have more serious virus than I thought, or this could be something else. We will now have to work outside Windows in order to fix this:


Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.

• Plug the flashdrive into the infected PC.
• Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer
• Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

• In the command window type in notepad and press Enter.
• When notepad opens, click File and select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst64.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run. When the tool opens click Yes to disclaimer.
• Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

 

[thegunshow101]

I have Frst on a usb key.. however as soon as I hit f8.. it just brings me back to the same screen that I sent you in the screenshot (immediately).. Its just a cycle and I can't get into an 'advanced menu' to choose repair..

 

[TwinHeadedEagle]

Try pressing F8 several times.

 

[thegunshow101]

No F8 works.. but not as desired.. It immediately dumps me back into the same error screen as my screenshot..

I'm kind of stuck.. I'm back at my office now though.. I have the windows installer. Should I do a 'repair computer"?.. and, if I do this what is this going to do to my current install/data/programs.. etc?

Or do you have a better idea?

Thanks in advance..

 

[TwinHeadedEagle]

Please download the following tools on your Desktop:

1. Farbar Recovery Scan Tool x64
2. Rufus
3. Windows 7 RC x64

• Insert your USB and then start Rufus
• Select the ISO file win7 64bit rc.iso on the desktop via the ISO icon.

• Under the Device select your USB Flash.
• Press Start
• When the process is complete, copy Farbar Recovery Scan Tool x64 on this USB

• Insert USB into infected computer and power on the computer. Now you need to set your computer to boot from USB. In order to do that, follow this guide.
• When you boot from USB, you will see image like this:

• Click Repair your computer
• Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

• In the command window type in notepad and press Enter.
• When notepad opens, click File and select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst64.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run. When the tool opens click Yes to disclaimer.
• Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

 

[thegunshow101]

Amazing fast responses... Let me work on this.. Thanks