Supra Savings Mess #?

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Supra Savings Mess #? Jul 23, 2014 22:45:28 GMT -8

Post by Quads on Jul 23, 2014 22:45:28 GMT -8

Start OTL, Right click "Run as Administrator"

Under

Copy and paste What I have put in the .txt file I have attached, all the way to the bottom ([REBOOT] is the last command line) , It is in the correct line by line layout as it is to be for OTL to understand, what I want it to do.
(include the : at the start of :OTL and all the way to the end / bottom) and run the script. (Red Run Fix Button)

The output log, should be placed in the C:\_OTL\MovedFiles folder after, to attach back here. Looks like a txt file not a Folder

Quads

marcymuss New Helpee Posts: 24	Supra Savings Mess #? Jul 26, 2014 17:34:31 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by marcymuss on Jul 26, 2014 17:34:31 GMT -8 Completed. Log file attached. Thank you. Attachment Deleted

Quads Malware Removalists In New Zealand Posts: 9,387	Supra Savings Mess #? Jul 26, 2014 17:39:53 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Quads on Jul 26, 2014 17:39:53 GMT -8 Seeing as PUP's started to install again Run Adwcleaner again to create a log to see if any items appear again. Quads

marcymuss
New Helpee

Posts: 24

Supra Savings Mess #? Jul 27, 2014 14:17:24 GMT -8

Post by marcymuss on Jul 27, 2014 14:17:24 GMT -8

Run only (no delete). See log below. Thank you.

# AdwCleaner v3.300 - Report created 27/07/2014 at 15:04:26
# Updated 27/07/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : Marcy - MARCYS
# Running from : C:\Users\Marcy\Desktop\adwcleaner_3.300.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk
Folder Found : C:\Users\Marcy\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiimolhnbbbdagljikeckdkldgemmmlj
Folder Found : C:\Users\Marcy\Favorites\StumbleUpon

***** [ Scheduled Tasks ] *****

Task Found : Advanced System Protector

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\SearchProtectINT
Key Found : [x64] HKCU\Software\SearchProtectINT
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
Key Found : HKLM\Software\systweak
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17126

-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Marcy\AppData\Roaming\Mozilla\Firefox\Profiles\0by6rjii.default\prefs.js ]

-\\ Google Chrome v36.0.1985.125

[ File : C:\Users\Marcy\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [11908 octets] - [10/07/2014 23:21:23]
AdwCleaner[R1].txt - [11923 octets] - [13/07/2014 09:11:09]
AdwCleaner[R2].txt - [11984 octets] - [13/07/2014 15:42:58]
AdwCleaner[R3].txt - [1707 octets] - [27/07/2014 15:04:26]
AdwCleaner[S0].txt - [11840 octets] - [13/07/2014 15:47:06]

########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [1828 octets] ##########

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Supra Savings Mess #? Jul 27, 2014 14:42:00 GMT -8

Post by Quads on Jul 27, 2014 14:42:00 GMT -8

I see what is seen as iffy in the packages folder as Adwcleaner listed one item for it StumpleUpon

a) Click the Scan Button and wait for the scan to finish,. (already done if Adwcleaner is left pending)

b) Make sure in your case this item listed by Adwcleaner is NOT selected for removal Folder Found : C:\Users\Marcy\Favorites\StumbleUpon
all of the rest of the items under each TAB are to be ticked. just not the one in red above.

c) Click the Clean Button and Adwcleaner will process all the items ticked / checked and then may ask for the system to be restarted.

d) It should create a new log afterwards (with S0 in the name).

Here is a Screenshot example

http://community.norton.com/t5/image/serverpage/image-id/40743i88953CBAC510F6CF/image-size/original?v=mpbl-1&px=-1

Quads

marcymuss
New Helpee

Posts: 24

Supra Savings Mess #? Jul 28, 2014 9:14:35 GMT -8

Post by marcymuss on Jul 28, 2014 9:14:35 GMT -8

Completed. See below. Thank you

# AdwCleaner v3.301 - Report created 28/07/2014 at 09:24:35
# Updated 28/07/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : Marcy - MARCYS
# Running from : C:\Users\Marcy\Desktop\adwcleaner_3.301.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : netfilter64

***** [ Files / Folders ] *****

[x] Not Deleted : C:\Users\Marcy\Favorites\StumbleUpon
Folder Deleted : C:\Users\Marcy\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiimolhnbbbdagljikeckdkldgemmmlj
File Deleted : C:\WINDOWS\System32\drivers\netfilter64.sys

***** [ Scheduled Tasks ] *****

Task Deleted : Advanced System Protector

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Deleted : HKCU\Software\SearchProtectINT
Key Deleted : HKLM\Software\systweak

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17126

-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Marcy\AppData\Roaming\Mozilla\Firefox\Profiles\0by6rjii.default\prefs.js ]

-\\ Google Chrome v36.0.1985.125

[ File : C:\Users\Marcy\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [11908 octets] - [10/07/2014 23:21:23]
AdwCleaner[R1].txt - [11923 octets] - [13/07/2014 09:11:09]
AdwCleaner[R2].txt - [11984 octets] - [13/07/2014 15:42:58]
AdwCleaner[R3].txt - [1916 octets] - [27/07/2014 15:04:26]
AdwCleaner[R4].txt - [1985 octets] - [28/07/2014 09:21:21]
AdwCleaner[S0].txt - [11840 octets] - [13/07/2014 15:47:06]
AdwCleaner[S1].txt - [1875 octets] - [28/07/2014 09:24:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1935 octets] ##########

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Supra Savings Mess #? Jul 28, 2014 10:20:14 GMT -8

Post by Quads on Jul 28, 2014 10:20:14 GMT -8

How is your system running now?? before removing all the disinfect tools (files, folders and keys).

Also as some PUP's got to some extent installed again users using your system may want to read this blog.emsisoft.com/2013/12/23/what-is-a-pup/

Quads

marcymuss
New Helpee

Posts: 24

Supra Savings Mess #? Jul 29, 2014 11:39:55 GMT -8

Post by marcymuss on Jul 29, 2014 11:39:55 GMT -8

Running very well. Only issue is that some of the Windows8 "apps" seem to be hung up (Netflix, Amazon, etc). Others (MS Office programs for instance) are fine, so I can just remove and reinstall apps that appear problematic. Not even sure if it's related.

Everything else is fantastic. I will pass along the PUP info as well. I've had issues with PUPs before that my McAfee didn't catch, but none so troublesome as Supra Savings!

Thanks once again - your efforts are very much appreciated

Marcy

Quads Malware Removalists In New Zealand Posts: 9,387	Supra Savings Mess #? Jul 29, 2014 15:00:09 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Quads on Jul 29, 2014 15:00:09 GMT -8 Some programs for the likes Netflix, Amazon (etc) can be see as PUP's in the way they work, you can completely uninstall and reinstall if you like. Quads

marcymuss New Helpee Posts: 24	Supra Savings Mess #? Jul 30, 2014 7:12:54 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by marcymuss on Jul 30, 2014 7:12:54 GMT -8 That's what I'll do. Is it ok to uninstall/remove the anti-malware software and files we've been using (FRST64, ODL, ADWCleaner)? Thanks for everything. Marcy

Post by Quads on Jul 23, 2014 22:45:28 GMT -8

Post by marcymuss on Jul 26, 2014 17:34:31 GMT -8

Post by Quads on Jul 26, 2014 17:39:53 GMT -8

Post by marcymuss on Jul 27, 2014 14:17:24 GMT -8

Post by Quads on Jul 27, 2014 14:42:00 GMT -8

Post by marcymuss on Jul 28, 2014 9:14:35 GMT -8

Post by Quads on Jul 28, 2014 10:20:14 GMT -8

Post by marcymuss on Jul 29, 2014 11:39:55 GMT -8

Post by Quads on Jul 29, 2014 15:00:09 GMT -8

Post by marcymuss on Jul 30, 2014 7:12:54 GMT -8