"Flash Player Pro" virus and browser hijack virus

Hi,

my laptop is Windows 8.1 Proo 64-bit on a sony vaio.

my laptop is infected with 2 things : "Flash Player Pro" and browser hijack, where, every site i try to open , gets redirected to mbox.com or candyoyo.

I found this thread below and ran the tools :

http://www.bleepingcomputer.com/forums/t/554256/flash-player-pro-and-mystery-app/#entry3523433

FSS

MTB

MBAM

rKill

MBAR

AdwCleaner

JRT

TFC

I'll post the logs in the next reply, in few minutes...

any other tools I should run?

Pls help.

there are too many log files, 5-7 in total.

Do i copy-paste or attach them in this post? pls advice. I cannot find the option to attach files, when I clicked "more reply options".

also, I cannot download "SecurityCheck.exe" from http://screen317.spywareinfoforum.org/SecurityCheck.exe. it's broken or not found.

any alternatives to "SecureCheck"?

Edited by mageshmss, 02 August 2015 - 11:16 AM.

Are you still being hit with ads, redirects, etc

Did you allow the scanners....especially MBAM, AdwCleaner and JRT to remove/ quarantine what they found?

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars....especially Google.

After install, open CCleaner and run by clicking on the Run Cleaner button in the bottom right corner.

CCleaner - PC Optimization and Cleaning - Free Download

Please rerun AdwCleaner and post the results

Download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Scan button.
• When the scan has finished click on Clean button.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

• Hold down Control and click on this link to open ESET OnlineScan in a new window.
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
• Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the icon on your desktop.
• Check "YES, I accept the Terms of Use."
• Click the Start button.
• Accept any security warnings from your browser.
• Under scan settings, check "Scan Archives" and "Remove found threats"
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click List Threats
• Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Click the Back button.
• Click the Finish button.
• NOTE:Sometimes if ESET finds no infections it will not create a log.

Hi BC! after running CCleaner and the earlier said tools, I was able to access google, but when I access youtube and facebook, it prompts me to "flash player pro" virus.

Then I restarted my laptop (which I didnt do after the cleanup) and the issue was gone. but am still afraid that I might have the virus.

Any other scans I should run?

Do I need to post the logs here for verification?

Edited by mageshmss, 03 August 2015 - 08:34 AM.

Yes, post the log for AdwCleaner.

Be sure to run the Eset Online scan. Post its log too if it finds and removes anything.

After posting the logs for the above two programs, do this:

After running CCleaner...post the three lists mentioned below using CCleaner:

Open CCleaner and click on Tools. Choose Startups. On that page you will see a list of Windows Startups and at the top tabs for each browser and Scheduled Tasks.

At the bottom right of that page you will see a button when clicked will allow you to Copy and Paste the list of Windows Startups and Scheduled Tasks into your next

post. Please do that.

Open CCleaner and click on Tools. Choose Uninstall. On that page you will see a list of programs installed on your computer and at the bottom right of that page you

will see a button when clicked will allow you to Copy and Paste that list in your next post. Please do that.

Log for AdwCleaner. i HAVE 3 LOGS, R1,R0,S0 listed respectively below :

---------------------------------START R1----------------------------

# AdwCleaner v4.208 - Logfile created 02/08/2015 at 19:36:18

# Updated 09/07/2015 by Xplode

# Database : 2015-08-01.1 [Server]

# Operating system : Windows 8.1 Pro  (x64)

# Username : magesh - M2K13-LT-WIN8

# Running from : C:\Users\magesh\Desktop\cleanupmess\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml

Folder Found : C:\Users\magesh\Documents\hosts

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\.bdc

Key Found : HKLM\SOFTWARE\Classes\.bgl

Key Found : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17840

-\\ Mozilla Firefox v39.0 (x86 en-US)

-\\ Google Chrome v44.0.2403.125

[C:\Users\magesh\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\magesh\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1378 bytes] - [02/08/2015 19:30:44]

AdwCleaner[R1].txt - [1299 bytes] - [02/08/2015 19:36:18]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [1358 bytes] ##########

---------------------------------END R1---------------------------------

---------------------------------START R0----------------------------

# AdwCleaner v4.208 - Logfile created 02/08/2015 at 19:30:44

# Updated 09/07/2015 by Xplode

# Database : 2015-08-01.1 [Server]

# Operating system : Windows 8.1 Pro  (x64)

# Username : magesh - M2K13-LT-WIN8

# Running from : C:\Users\magesh\Desktop\cleanupmess\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml

Folder Found : C:\Users\magesh\Documents\hosts

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\.bdc

Key Found : HKLM\SOFTWARE\Classes\.bgl

Key Found : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17840

-\\ Mozilla Firefox v39.0 (x86 en-US)

-\\ Google Chrome v44.0.2403.125

[C:\Users\magesh\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\magesh\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1240 bytes] - [02/08/2015 19:30:44]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1299 bytes] ##########

---------------------------------END R0---------------------------------

---------------------------------START S0----------------------------

# AdwCleaner v4.208 - Logfile created 02/08/2015 at 19:38:34

# Updated 09/07/2015 by Xplode

# Database : 2015-08-01.1 [Server]

# Operating system : Windows 8.1 Pro  (x64)

# Username : magesh - M2K13-LT-WIN8

# Running from : C:\Users\magesh\Desktop\cleanupmess\AdwCleaner.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

[!] Folder Deleted : C:\Users\magesh\Documents\hosts

File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\.bdc

Key Deleted : HKLM\SOFTWARE\Classes\.bgl

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17840

-\\ Mozilla Firefox v39.0 (x86 en-US)

-\\ Google Chrome v44.0.2403.125

[C:\Users\magesh\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

[C:\Users\magesh\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1378 bytes] - [02/08/2015 19:30:44]

AdwCleaner[R1].txt - [1437 bytes] - [02/08/2015 19:36:18]

AdwCleaner[S0].txt - [1380 bytes] - [02/08/2015 19:38:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1439  bytes] ##########

---------------------------------END S0---------------------------------

ESET Scan found a pup, it said, but it was on my E: partition, not C:. but i dleted it anyway.

------------START ESET------------------

E:\From-E-W520\Downloads-other\winzip16-64.exe a variant of Win32/Systweak.L potentially unwanted application

Cleaner logs below for Windows Startups and ScheduledTasks:

--------------START WINDOWS STARTUP-----------------

Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR

Yes HKCU:Run OfficeSyncProcess Microsoft Corporation "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"

No HKLM:Run Adobe Reader Speed Launcher Adobe Systems Incorporated "c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

No HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

Yes HKLM:Run BTMTrayAgent Microsoft Corporation rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

No HKLM:Run Dolby Home Theater v4 Dolby Laboratories Inc. "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart

Yes HKLM:Run HotKeysCmds Intel Corporation "C:\WINDOWS\system32\hkcmd.exe"

Yes HKLM:Run IgfxTray Intel Corporation "C:\WINDOWS\system32\igfxtray.exe"

Yes HKLM:Run ISBMgr.exe Sony Corporation "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"

Yes HKLM:Run Persistence Intel Corporation "C:\WINDOWS\system32\igfxpers.exe"

Yes HKLM:Run RtHDVBg Realtek Semiconductor C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO 

Yes HKLM:Run RtHDVBg_Dolby Realtek Semiconductor C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 

Yes HKLM:Run SunJavaUpdateSched Oracle Corporation "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

--------------END WINDOWS STARTUP---------------------

--------------START SCHEDULED TASKS-----------------

Yes Task Adobe Flash Player Updater Adobe Systems Incorporated C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)

Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c

Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

No Task Optimize Start Menu Cache Files-S-1-5-21-3489357808-206878928-3034863937-1002

Yes Task USER_ESRV_SVC Microsoft Corporation "C:\WINDOWS\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"

Yes Task {F097BDBD-D2F5-402E-BE01-F88B5F75AD01} Microsoft Corporation C:\WINDOWS\system32\pcalua.exe -a C:\Users\magesh\AppData\Local\Temp\neoNCSetup.exe -d "C:\Users\magesh\AppData\Roaming\Juniper Networks\Setup Client" -c  en

--------------END SCHEDULED TASKS---------------------

list of installed programs from CCleaner below :

----------------- START INSTALL LIST-----------------------

7-Zip 9.20 (x64 edition) Igor Pavlov 6/25/2013 4.53 MB 9.20.00.0

Adobe Reader X (10.1.15) MUI Adobe Systems Incorporated 7/30/2015 482 MB 10.1.15

Apple Application Support (32-bit) Apple Inc. 4/10/2015 94.2 MB 3.1.3

Apple Application Support (64-bit) Apple Inc. 4/10/2015 109 MB 3.1.3

Apple Mobile Device Support Apple Inc. 4/10/2015 27.9 MB 8.1.1.3

Apple Software Update Apple Inc. 6/15/2013 2.38 MB 2.1.3.127

CCleaner Piriform 8/3/2015 5.08

Cisco WebEx Meetings Cisco WebEx LLC 9/9/2014

CyberLink Power2Go 8 CyberLink Corp. 3/8/2013 281 MB 8.0.0.1923

CyberLink PowerDVD CyberLink Corp. 3/8/2013 188 MB 9.0.5601.52

Dolby Home Theater v4 Dolby Laboratories Inc 3/8/2013 2.44 MB 7.2.8000.16

ESET Online Scanner v3 8/2/2015

Flickr Uploadr 3.2.1 2/23/2014

Google Chrome Google Inc. 7/30/2015 44.0.2403.125

Google Drive Google, Inc. 7/18/2015 33.8 MB 1.23.9648.8824

Intel® Management Engine Components Intel Corporation 6/16/2013 8.1.0.1252

Intel® Processor Graphics Intel Corporation 2/23/2014 10.18.10.3304

Intel® PROSet/Wireless for Bluetooth® + High Speed Intel Corporation 3/9/2014 5.72 MB 15.5.0.0344

Intel® PROSet/Wireless Software for Bluetooth® Technology Motorola Solutions, Inc 3/8/2013 30.6 MB 2.5.0.0248

Intel® Rapid Storage Technology Intel Corporation 8/3/2015 11.5.3.1004

Intel® SDK for OpenCL - CPU Only Runtime Package Intel Corporation 6/16/2013 2.0.0.37149

Intel® WiDi Intel Corporation 3/8/2013 121 MB 3.5.34.0

Intel® PROSet/Wireless WiFi Software Intel Corporation 3/8/2013 156 MB 15.05.1000.1411

Java 8 Update 45 Oracle Corporation 6/18/2015 77.1 MB 8.0.450

Java 8 Update 45 (64-bit) Oracle Corporation 6/18/2015 89.0 MB 8.0.450

Malwarebytes Anti-Malware version 2.1.8.1057 Malwarebytes Corporation 8/2/2015 64.6 MB 2.1.8.1057

Microsoft Office Home and Student 2010 Microsoft Corporation 3/5/2014 14.0.7015.1000

Microsoft Silverlight Microsoft Corporation 5/15/2015 100 MB 5.1.40416.0

Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 6/16/2013 290 KB 8.0.56336

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 6/15/2013 860 KB 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 6/16/2013 13.2 MB 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 3/8/2013 10.2 MB 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 6/15/2013 664 KB 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 6/15/2013 1.26 MB 9.0.30729.6161

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 Microsoft Corporation 3/5/2015 13.8 MB 10.0.40219

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 Microsoft Corporation 3/5/2015 11.1 MB 10.0.40219

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 3/5/2015 10.0.50903

Mozilla Firefox 39.0 (x86 en-US) Mozilla 7/30/2015 84.6 MB 39.0

Mozilla Maintenance Service Mozilla 7/30/2015 228 KB 39.0

Norton Internet Security Symantec Corporation 7/29/2015 20.6.0.27

NVIDIA Graphics Driver 327.02 NVIDIA Corporation 3/3/2014 327.02

NVIDIA PhysX System Software 9.12.0613 NVIDIA Corporation 3/8/2013 9.12.0613

NVIDIA Update 1.14.17 NVIDIA Corporation 3/3/2014 1.14.17

Realtek Ethernet Controller Driver Realtek 3/8/2013 8.2.612.2012

Realtek High Definition Audio Driver Realtek Semiconductor Corp. 2/23/2014 6.0.1.6685

Realtek PCIE Card Reader Realtek Semiconductor Corp. 3/8/2013 6.1.8400.28121

Skype™ 7.0 Skype Technologies S.A. 4/17/2015 47.8 MB 7.0.102

Synaptics Pointing Device Driver Synaptics Incorporated 5/28/2015 46.4 MB 19.0.5.0

VAIO Care Sony Corporation 1/3/2015 102 MB 8.4.2.12046

VAIO Care Recovery Sony Corporation 4/22/2014 31.5 MB 1.1.2.13230

VAIO Control Center Sony Corporation 3/8/2013 6.0.0.08200

VAIO CPU Fan Diagnostic Sony Corporation 3/8/2013 1.1.0.09200

VAIO Data Restore Tool Sony Corporation 3/8/2013 1.10.0.07270

VAIO Gesture Control Sony Corporation 3/8/2013 2.0.0.08240

VAIO Health Report Sony Electronics 2/23/2014 1.0

VAIO Improvement Sony Corporation 3/8/2013 2.0.0.08090

VAIO Manual Sony Corporation 3/8/2013 3.0.0.08100

VAIO Media Server Settings Sony Corporation 3/8/2013 87.9 MB 1.0.0.08240

VAIO Update Sony Corporation 4/1/2015 7.0.1.02280

VMware Player VMware, Inc 4/8/2014 390 MB 5.0.2

------------------ END INSTALL LIST ------------------------

Suggest disabling these Windows Startups: (Use CCleaner by clicking on each item to highlight and then choosing on the right to Disable or Remove or Uninstall)

Yes HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR

Yes HKLM:Run IgfxTray Intel Corporation "C:\WINDOWS\system32\igfxtray.exe"

Yes HKLM:Run SunJavaUpdateSched Oracle Corporation "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

Suggest Disabling these Tasks:

Yes Task Adobe Flash Player Updater Adobe Systems Incorporated C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Yes Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)

Yes Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c

Yes Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

Is the computer performing up to par?

Thanks BC! I did all what you said. Anything else, I should run?

The computer is running up to par, now.

Does it help to create a restore point using Windows 8.1 at this time(post cleanup)? I have not created a restore point since I bought this laptop.

Do I need to format my C: and reinstall Windows 8.1, just to make sure everything is good?

Thanks a TON to BC and BC Advisor!

--M

I think you are good to go. Sure, create a restore point. No need to reinstall....if I thought that I would not of attempted to clean the computer. It was just some adware...nothing malicious.

Happy surfin'...