Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: told to come to READ BEFORE REQUESTING HELP WITH MALWARE REMOVAL .BUT TOO LATE  (Read 5047 times)

0 Members and 1 Guest are viewing this topic.

crann01

    Topic Starter


    Rookie

    Read the thread but already ran scans on AVG, Malawarebytes, and Super anti spyware, and CCleaner before coming to Computer Hope..

    I have a used computer from sister in law, When you turn it on , It asked for a reentry of the Windows 7 Product Key... I chose ask later.. and got to the desktop..I went on internet to update all the above software(programs).Scanned for each one.. making sure I am off the internet , and only one program running at a time..either by disabling them or exiting them.

    There were so many threats, viruses, spyware. malaware, that I feel that the Windows 7 Product key may be a virus ect..
    11 on AVG.. 18 on Malaware, and 1130 last night on Super anti spyware, and 1180 on Super anti spyware after updating this morning..


     I am trying to get all of her info, documents. pictures ect off and put on CDs. Will have to mail them to her.
    I want to get the computer clean for my husband. I did put him on as a administrator, so I can remove her when I get all of her files off..

    Is ghost a good program or just use alot of CDs..there are hundreds of important documents and pictures ect.

     Any suggestions for what I should do?

    SuperDave

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
    *************************************************************************
    Please download AdwCleaner by Xplode onto your Desktop.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Search.
    • A logfile will automatically open after the scan has finished.
    • Please post the content of that logfile in your reply.
    • You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.
    *********************************************
    1. Download this diagnostics tool MGADiag.ext and save this to your Desktop.
    2. Double-click on MGADiag.exe and click Continue
    3. When the program has finished, click on Copy
    4. Post the results in your next reply.

    ***********************************************
    Download Security Check by screen317 from one of the following links and save it to your desktop.

    Link 1
    Link 2

    * Double-click Security Check.bat
    * Follow the on-screen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt
    * Post the contents of that document in your next reply.

    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
    Windows 8 and Windows 10 dual boot with two SSD's

    crann01

      Topic Starter


      Rookie

      Hi Dave,

      Just heard from sis in law that she used the computer for along time , and the Windows 7 issue with the product key was always there, so I am no concerned about that, I will have to get started on it tommorrow. But I will follow your instructions, and will send the logs back to this thread. I don't want to get any of her files off till I know there are no more infections ect. Thanks for the response to my post.



      Crann01

      SuperDave

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      It sounds like it was never validated.
      Windows 8 and Windows 10 dual boot with two SSD's

      crann01

        Topic Starter


        Rookie

        # AdwCleaner v2.011 - Logfile created 12/04/2012 at 13:09:06
        # Updated 02/12/2012 by Xplode
        # Operating system : Windows 7 Ultimate  (32 bits)
        # User : Gale - GALE-PC
        # Boot Mode : Normal
        # Running from : C:\Users\Gale\Downloads\adwcleaner.exe
        # Option [Search]


        ***** [Services] *****


        ***** [Files / Folders] *****

        File Found : C:\user.js
        Folder Found : C:\Program Files\Conduit
        Folder Found : C:\Users\Gale\AppData\Local\Conduit
        Folder Found : C:\Users\Gale\AppData\LocalLow\Conduit
        Folder Found : C:\Users\Gale\AppData\LocalLow\CouponAlert_2p
        Folder Found : C:\Users\Gale\AppData\LocalLow\FunWebProducts
        Folder Found : C:\Users\Gale\AppData\LocalLow\incredibar.com
        Folder Found : C:\Users\Gale\AppData\LocalLow\MyWebSearch
        Folder Found : C:\Users\Gale\AppData\LocalLow\PriceGong

        ***** [Registry] *****

        Key Found : HKCU\Software\AppDataLow\Software\Conduit
        Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
        Key Found : HKCU\Software\AppDataLow\Software\Fun Web Products
        Key Found : HKCU\Software\AppDataLow\Software\FunWebProducts
        Key Found : HKCU\Software\AppDataLow\Software\iWon
        Key Found : HKCU\Software\AppDataLow\Software\PriceGong
        Key Found : HKCU\Software\AppDataLow\Software\SmartBar
        Key Found : HKCU\Software\IM
        Key Found : HKCU\Software\ImInstaller
        Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
        Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{042DA63B-0933-403D-9395-B49307691690}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8736C681-37A0-40C6-A0F0-4C083409151C}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0BDF6C42-132C-45F5-92DE-DC13F40C6DAB}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
        Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
        Key Found : HKCU\Software\Softonic
        Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
        Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2559647
        Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3201318
        Key Found : HKLM\Software\Conduit
        Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
        Key Found : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
        Key Found : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
        Key Found : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
        Key Found : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
        Key Found : HKU\S-1-5-21-2607335001-424716979-4239846411-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
        Key Found : HKU\S-1-5-21-2607335001-424716979-4239846411-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
        Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
        Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]
        Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D7E97865-918F-41E4-9CD0-25AB1C574CE8}]

        ***** [Internet Browsers] *****

        -\\ Internet Explorer v8.0.7600.16839

        [OK] Registry is clean.

        -\\ Google Chrome v23.0.1271.95

        File : C:\Users\Gale\AppData\Local\Google\Chrome\User Data\Default\Preferences

        [OK] File is clean.

        *************************

        AdwCleaner[R1].txt - [5209 octets] - [04/12/2012 12:56:21]
        AdwCleaner[R2].txt - [5140 octets] - [04/12/2012 13:09:06]

        ########## EOF - C:\AdwCleaner[R2].txt - [5200 octets] ##########

        crann01

          Topic Starter


          Rookie

           Results of screen317's Security Check version 0.99.56 
           Windows 7  x86 (UAC is disabled!) 
           Out of date service pack!![/b]
           Internet Explorer 8 Out of date!
          ``````````````Antivirus/Firewall Check:``````````````[/u]
           Windows Firewall Enabled! 
          AVG Anti-Virus Free Edition 2013   
           Antivirus out of date! 
          `````````Anti-malware/Other Utilities Check:`````````[/u]
           SUPERAntiSpyware     
           Malwarebytes Anti-Malware version 1.65.1.1000 
           CCleaner     
           Java(TM) 6 Update 22 
           Java version out of Date!
           Adobe Flash Player 10 Flash Player out of Date!
           Adobe Reader 9 Adobe Reader out of Date!
           Google Chrome 23.0.1271.95 
          ````````Process Check: objlist.exe by Laurent````````[/u] 
           AVG avgwdsvc.exe
          `````````````````System Health check`````````````````[/u]
           Total Fragmentation on Drive C: 1%
          ````````````````````End of Log``````````````````````[/u]

          crann01

            Topic Starter


            Rookie

            the windows valadation does not want to copy,, I can get on my computer and type what it says in a reply...Just let me know if that is what you want???

            Guess it is not a good windows version.. I will deal with that later...

            SuperDave

            • Malware Removal Specialist
            • Moderator


            • Genius
            • Thanked: 1020
            • Certifications: List
            • Experience: Expert
            • OS: Windows 10
            Remove the Adware:
            • Please close all open programs and internet browsers.
            • Double click on adwcleaner.exe to run the tool.
            • Click on Delete.
            • Confirm each time with OK
            • Your computer will be rebooted automatically. A text file will open after the restart.
            • Please post the content of that logfile in your reply.
            • You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.
            *************************************************
            Your AVG is out-of-date. Please update it.

            Go to Microsoft Windows Update and get all critical updates.

            Update Your Java (JRE)

            Old versions of Java have vulnerabilities that malware can use to infect your system.


            First Verify your Java Version

            If there are any other version(s) installed then update now.

            Get the new version (if needed)

            If your version is out of date install the newest version of the Sun Java Runtime Environment.

            Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

            Be sure to close ALL open web browsers before starting the installation.

            Remove any old versions

            1. Download JavaRa and unzip the file to your Desktop.
            2. Open JavaRA.exe and choose Remove Older Versions
            3. Once complete exit JavaRA.

            Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
            *******************************************
            Update your Adobe Reader. get.adobe.com/reader.

            Be sure to uncheck the Free McAfee Security Scan so it isn't installed.

            ********************************************
            Quote
            Guess it is not a good windows version.. I will deal with that later...
            If it's not a genuine Windows version you will need to deal with it now. It's quite possible that version of Windows is infected.
            Windows 8 and Windows 10 dual boot with two SSD's

            crann01

              Topic Starter


              Rookie

              Hi Dave,

               Will do all of this today.

              On the windows 7 Operating System do I purchase a key.. or format and install a full version?
              Are there safe places to download it or purchase a CD. Not close to any store other then Walmart.(They might have a full version.)


              Thanks again for all of your help and the fast response to my post.


              crann01


              SuperDave

              • Malware Removal Specialist
              • Moderator


              • Genius
              • Thanked: 1020
              • Certifications: List
              • Experience: Expert
              • OS: Windows 10
              Hi Dave,

               Will do all of this today.

              On the windows 7 Operating System do I purchase a key.. or format and install a full version?
              Are there safe places to download it or purchase a CD. Not close to any store other then Walmart.(They might have a full version.)


              Thanks again for all of your help and the fast response to my post.
              You should contact MicroSoft about this problem. I'm sure they will help you solve this.


              crann01
              Windows 8 and Windows 10 dual boot with two SSD's