Solved Another infection

[theRadiantChild]

C:\couture2013\2 - laurens documents\Downloads\setup.exe a variant of Win32/AirAdInstaller.A potentially unwanted application deleted - quarantined
C:\couture2013\3 - teras documents\Downloads\PIP267_AVR10_ (1).exe a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application deleted - quarantined
C:\couture2013\3 - teras documents\Downloads\PIP267_AVR10_.exe a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application deleted - quarantined
C:\couture2013\4 - more folders\Documents and Settings\Tera_2\Local Settings\Temp\ToolbarUpdater_1289332468\autoUpdater.exe a variant of Win32/Toolbar.Conduit.B potentially unwanted application deleted - quarantined
C:\couture2013\4 - more folders\Documents and Settings\Tera_2\My Documents\Downloads\PIP267_AVR10_ (1).exe a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application deleted - quarantined
C:\couture2013\4 - more folders\Documents and Settings\Tera_2\My Documents\Downloads\PIP267_AVR10_.exe a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application deleted - quarantined
C:\Users\Couture Closet\AppData\Roaming\0T1F0D1F2W1G1I1F1T1Q\PrimoPDF Packages\uninstaller.exe Win32/InstallCore.AZ potentially unwanted application deleted - quarantined
C:\Users\Couture Closet\Downloads\primopdf setup.exe a variant of Win32/InstallCore.AZ potentially unwanted application deleted - quarantined
C:\Users\Tera\Downloads\ZipOpenerSetup.exe a variant of Win32/InstallCore.NN potentially unwanted application deleted - quarantined

 

[Broni]

..and Security Check...

 

[theRadiantChild]

Still getting pop ups in chrome....

Results of screen317's Security Check version 0.99.89
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
Trend Micro Titanium Internet Security
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Google Chrome 35.0.1916.153
Google Chrome 38.0.2125.111
Google Chrome update.dll..
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
Trend Micro Titanium TiMiniService.exe
Trend Micro Titanium TiResumeSrv.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

 

[Broni]

Update Adobe Flash Player: http://get.adobe.com/flashplayer/
Make sure you UN-check Yes, install McAfee Security Scan Plus

NOTE 1: Beginning with Adobe Flash Version 11.3, the universal installer includes the 32-bit and 64-bit versions of the Flash Player.
NOTE 2: While installing make sure you UN-check any extra garbage which wants to install alongside.

Reset Chrome...
Click on "Customize and control Google Chrome":

Click "Settings" then "Show advanced settings" at the bottom of the screen.
Click "Reset browser settings" button.
Restart Chrome.

If the above didn't help....

Reinstall Chrome...
If you want to save your bookmarks...
How to Backup Bookmarks in Google Chrome

• Close all Chrome windows and tabs.
• Go to the Start menu > Control Panel. (Windows 8 users: Learn how to access the Control Panel)
• Click Programs and Features.
• Double-click Google Chrome.
• Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, by selecting the "Also delete your browsing data" checkbox.

Install fresh copy.

 

[theRadiantChild]

Ok chrome seems to be working good now

 

[Broni]

Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download

DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create registry backup
• Purge System Restore
• Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.

 

[theRadiantChild]

This one is looking good. Thanks a million!!!!

 

[Broni]

Way to go!!
Good luck and stay safe

 

[theRadiantChild]

We may need to revisit this one again, Broni. The other two logins for this machine are still getting bad pop-ups etc.

 

[theRadiantChild]

I was certain that our cleaning would of taken care of the entire infection on all logins but maybe not?

 

[Broni]

Are those browsers popups?

 

[theRadiantChild]

Yes, Tera's login seems fine but the other two logins are bad with browser popups where its un-usable. I installed adblock and wot on teras login but they did not install for the other logins.

 

[Broni]

Which browser(s) are affected there?

 

[theRadiantChild]

Think she is getting a neww HDD from dell so further cleaning wont be necessary. Thanks Broni.

 

[Broni]

Thanks for letting me know