Superanti spyware

possumpaw
Member

Posts: 83

Former World Start Member: Yes
World Start Name: possumpaw

Superanti spyware Mar 28, 2018 14:06:52 GMT -5

Quote

Post by possumpaw on Mar 28, 2018 14:06:52 GMT -5

I purchased this laptop new, three years ago, for my bro. that lives in Hawaii. He didn't use it more than a couple of weeks. He took three classes at the library before he lost his transportaion,(his only place for internet access). When they set it up for him they didn't install anything on it so it was reallu full of crap. Malwarebytes found two Rootkits and one Trojen that they quarantined. Sas has been very busy.. many thousand. After several scans I have finally gotten it down to 84. I have all the listed cleaners installed and spent hours updateing windows. My question is ... How do I cut down on all the incoming stuff from sas?

No, I'm not using IE
Thanks for any suggestions
pat

Dell inspiron 17 5758 Laptop

windows 7 with extra w8 disc

64 bit os

4.00 GB ram

non touchscreen

500 gig hd

Avast.

windows firewall

malwarebytes

sas

spywareblaster

Ccleaner

FireFox

possumpaw
Member

Posts: 83

Former World Start Member: Yes
World Start Name: possumpaw

Superanti spyware Mar 28, 2018 15:25:55 GMT -5

Quote

Post by possumpaw on Mar 28, 2018 15:25:55 GMT -5

Oops, forgot to post thia..
SUPERAntiSpyware Scan Log
www.superantispyware.com

Generated 03/28/2018 at 07:58 AM

Application Version : 6.0.1258
Database Version : 14509

Scan type : Quick Scan
Total Scan Time : 00:01:26

Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 707
Memory items detected : 0
Registry items scanned : 57487
Registry items detected : 0
File items scanned : 8310
File items detected : 84

Adware.Tracking Cookie
.infolinks.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.bttrack.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
match.rundsp.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
match.rundsp.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adsrvr.org [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adsrvr.org [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adsymptotic.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.storygize.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.scorecardresearch.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.scorecardresearch.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.infolinks.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.go.sonobi.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.go.sonobi.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.sitescout.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.agkn.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.amazon-adsystem.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.amazon-adsystem.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.media.adfrontiers.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adnxs.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.areyouahuman.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.areyouahuman.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.s.thebrighttag.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.s.thebrighttag.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.bidswitch.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.comcast.demdex.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.ipredictive.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.media.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.demdex.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.demdex.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.dpm.demdex.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rfihub.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.everesttech.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.openx.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adnxs.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.mookie1.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.universal.iperceptions.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.w55c.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.mookie1.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.dlx.addthis.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.dlx.addthis.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.addthis.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.openx.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.openx.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.ml314.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.powerlinks.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.pixel.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rfihub.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.srv.stackadapt.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.srv.stackadapt.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
px.powerlinks.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adnxs.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.spongecell.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.sitescout.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.media.adfrontiers.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.tidaltv.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
ib.3lift.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
ib.3lift.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.3lift.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.3lift.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.teads.tv [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.bidswitch.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
ad.360yield.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
ad.360yield.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.bidswitch.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.agkn.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adform.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.simpli.fi [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.turn.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
ad.360yield.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.dh.serving-sys.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
ad.360yield.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.mathtag.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.adnxs.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.mathtag.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.rubiconproject.com [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.media.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]
.w55c.net [ C:\USERS\ROBBY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4X9HXMHI.DEFAULT-1521851484861\COOKIES.SQLITE ]

============
End of Log
============

budgall
Chief

Global Moderator

Posts: 803

Former World Start Member: Yes
World Start Name: budgallxp

Superanti spyware Mar 28, 2018 15:30:32 GMT -5

Quote

Post by budgall on Mar 28, 2018 15:30:32 GMT -5

The link below takes you to the instructions for cleaning a computer. Follow them closely and post the log results. Once you have done that additional help will follow.

newworldtech.freeforums.net/thread/10/preliminary-cleanup-steps

jholland1964
Administrator

Posts: 2,690

Former World Start Member: Yes

Superanti spyware Mar 28, 2018 15:38:15 GMT -5

Quote

Post by jholland1964 on Mar 28, 2018 15:38:15 GMT -5

You may not need to run all of those Cleanup steps again. Since you've already run Malwarebytes' before can you please post the log from the Malwarebytes' scan that found and removed the infections?

Also, You don't have Firefox configured correctly to block 3rd party cookies, that is what is being found by SUPERAntispyware. Be sure and have it clean all of those cookies found.

On Firefox go to Tools, Options, Privacy and Security. History. Hit the down arrow right there and choose Use Custom Settings for History. Then put checkmarks next to Accept cookies from web sites and Accept 3rd party cookies to NEVER.

Last Edit: Mar 28, 2018 15:40:48 GMT -5 by jholland1964

Inspiron 15 5510 Windows 11 64bit
Vivaldi; EDGE; Mailbird; Windows Defender, Windows Firewall, MBAM FREE, SpywareBlaster

Inspiron 7591; Windows 10 64bit; Same programs as above.

possumpaw Member Posts: 83 Former World Start Member: Yes World Start Name: possumpaw	Superanti spyware Mar 28, 2018 16:20:45 GMT -5 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by possumpaw on Mar 28, 2018 16:20:45 GMT -5 Sorry, I've been using Edge for so long that I just haven't been able to learn about FF... Where do I find "Tools" in ff?

possumpaw
Member

Posts: 83

Former World Start Member: Yes
World Start Name: possumpaw

Superanti spyware Mar 28, 2018 16:34:03 GMT -5

Quote

Post by possumpaw on Mar 28, 2018 16:34:03 GMT -5

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/27/18
Scan Time: 9:52 AM
Log File: 3b9779cd-31df-11e8-b290-34e6ad72b5e5.json
Administrator: Yes

-Software Information-
Version: 3.4.4.2398
Components Version: 1.0.322
Update Package Version: 1.0.4510
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: robby-PC\robby

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 237040
Threats Detected: 3
Threats Quarantined: 3
Time Elapsed: 3 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 1
Rootkit.Fileless.MTGen, HKU\S-1-5-21-3803790379-3309614116-3586433765-1000_Classes\edixecvi\SHELL\OPEN\COMMAND, Quarantined, [6619], [261826],1.0.4510

Registry Value: 2
Rootkit.Fileless.MTGen, HKU\S-1-5-21-3803790379-3309614116-3586433765-1000_Classes\edixecvi\SHELL\OPEN\COMMAND|, Quarantined, [6619], [261826],1.0.4510
Trojan.Fileless.MTGen, HKU\S-1-5-21-3803790379-3309614116-3586433765-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^ZIQCAFO, Quarantined, [7084], [262349],1.0.4510

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

(end)

possumpaw
Member

Posts: 83

Former World Start Member: Yes
World Start Name: possumpaw

Superanti spyware Mar 28, 2018 16:37:03 GMT -5

Quote

Post by possumpaw on Mar 28, 2018 16:37:03 GMT -5

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/27/18
Scan Time: 9:52 AM
Log File: 3b9779cd-31df-11e8-b290-34e6ad72b5e5.json
Administrator: Yes

-Software Information-
Version: 3.4.4.2398
Components Version: 1.0.322
Update Package Version: 1.0.4510
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: robby-PC\robby

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 237040
Threats Detected: 3
Threats Quarantined: 3
Time Elapsed: 3 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 1
Rootkit.Fileless.MTGen, HKU\S-1-5-21-3803790379-3309614116-3586433765-1000_Classes\edixecvi\SHELL\OPEN\COMMAND, Quarantined, [6619], [261826],1.0.4510

Registry Value: 2
Rootkit.Fileless.MTGen, HKU\S-1-5-21-3803790379-3309614116-3586433765-1000_Classes\edixecvi\SHELL\OPEN\COMMAND|, Quarantined, [6619], [261826],1.0.4510
Trojan.Fileless.MTGen, HKU\S-1-5-21-3803790379-3309614116-3586433765-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^ZIQCAFO, Quarantined, [7084], [262349],1.0.4510

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

(end)

jholland1964
Administrator

Posts: 2,690

Former World Start Member: Yes

Superanti spyware Mar 28, 2018 18:24:37 GMT -5

Quote

Post by jholland1964 on Mar 28, 2018 18:24:37 GMT -5

Mar 28, 2018 16:20:45 GMT -5 possumpaw said:

Sorry, I've been using Edge for so long that I just haven't been able to learn about FF... Where do I find "Tools" in ff?

You said this was purchased new and then barely used. I am somewhat confused. Have YOU used it in the last three years? Somebody used it enough to get Rootkits on it.

You never said you were using Edge. The only browser you listed was Firefox and all of the 3rd party cookies found were in Firefox so somebody is using Firefox.

*See attachments* in order to set Firefox correctly.

You need to do the same in Edge. You will find that option in Advanced Settings

Attachments:

Last Edit: Mar 28, 2018 18:27:26 GMT -5 by jholland1964

Inspiron 15 5510 Windows 11 64bit
Vivaldi; EDGE; Mailbird; Windows Defender, Windows Firewall, MBAM FREE, SpywareBlaster

Inspiron 7591; Windows 10 64bit; Same programs as above.

possumpaw
Member

Posts: 83

Former World Start Member: Yes
World Start Name: possumpaw

Superanti spyware Mar 28, 2018 19:59:00 GMT -5

Quote

Post by possumpaw on Mar 28, 2018 19:59:00 GMT -5

Sorry for the confusion, Judy. Although the laptop is three yrs old it was only used for a few weeks.
When I sent it to my Bro. he was still able to drive to Hilo where he was taking computer lesson. That just lasted a few weeks before he failed the eye test for driving. There is a bus that he can take to Hilo but the bus stop is 5 miles from his home. A long walk when it's raining. A few weeks ago he told me he was sending it to me. So, no it hasn't been used in the past 3 years. I'm not sure where all the crap came from unless it was when I was setting it up
It's W7 and I am only using FF. with Comcast.
Judy, I really appreciate you posting pix of the instructions you give. Can't tell you how much easier it makes things.
I did get FF all set and Edge will be next.
Thanks bunches for your help..

P.S. Haven't been able to find where to put my computer info on post. Or do we just add it when we are making a post?

jholland1964
Administrator

Posts: 2,690

Former World Start Member: Yes

Superanti spyware Mar 28, 2018 20:17:16 GMT -5

Quote

Post by jholland1964 on Mar 28, 2018 20:17:16 GMT -5

Mar 28, 2018 19:59:00 GMT -5 possumpaw said:

Sorry for the confusion, Judy. Although the laptop is three yrs old it was only used for a few weeks.
When I sent it to my Bro. he was still able to drive to Hilo where he was taking computer lesson. That just lasted a few weeks before he failed the eye test for driving. There is a bus that he can take to Hilo but the bus stop is 5 miles from his home. A long walk when it's raining. A few weeks ago he told me he was sending it to me. So, no it hasn't been used in the past 3 years. I'm not sure where all the crap came from unless it was when I was setting it up
It's W7 and I am only using FF. with Comcast.
Judy, I really appreciate you posting pix of the instructions you give. Can't tell you how much easier it makes things.
I did get FF all set and Edge will be next.
Thanks bunches for your help..

P.S. Haven't been able to find where to put my computer info on post. Or do we just add it when we are making a post?

You want to add your signature, that is where you put your information. To do that do the following:
Click on your name. This will take you to your Profile. On your profile then click on Personal. Scroll down that page and you will see the box for Signature. Add your information right there.

Inspiron 15 5510 Windows 11 64bit
Vivaldi; EDGE; Mailbird; Windows Defender, Windows Firewall, MBAM FREE, SpywareBlaster

Inspiron 7591; Windows 10 64bit; Same programs as above.

jholland1964
Administrator

Posts: 2,690

Former World Start Member: Yes

Superanti spyware Mar 28, 2018 22:34:08 GMT -5

Quote

Post by jholland1964 on Mar 28, 2018 22:34:08 GMT -5

Giving this more thought, since you found Rootkits with the Malwarebytes' scan I think that you SHOULD definitely follow the advice given by budgall and run ALL steps given in the Preliminary Cleanup Steps
I was wrong telling you that was not necessary. newworldtech.freeforums.net/thread/10/preliminary-cleanup-steps

Please note that SUPERAntispyware is NOT part of those Preliminary steps so running that again will not be necessary, but AdwCleaner IS a very important part of those steps and you have not run that yet. So go back and run those steps in the exact order given there and then post the new Malwarebytes's log AND the log produced AFTER cleaning by AdwCleaner.

Rootkits are extremely dangerous so you need to be sure they are actually gone.

Inspiron 15 5510 Windows 11 64bit
Vivaldi; EDGE; Mailbird; Windows Defender, Windows Firewall, MBAM FREE, SpywareBlaster

Inspiron 7591; Windows 10 64bit; Same programs as above.

possumpaw Member Posts: 83 Former World Start Member: Yes World Start Name: possumpaw	Superanti spyware Mar 29, 2018 9:44:45 GMT -5 jholland1964 likes this Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by possumpaw on Mar 29, 2018 9:44:45 GMT -5 Sorry I missed this last night.. Will not be home til late this afternoon so will run programs then. Thanks for your patients.

jholland1964 Administrator Posts: 2,690 Former World Start Member: Yes	Superanti spyware Mar 30, 2018 19:05:41 GMT -5 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by jholland1964 on Mar 30, 2018 19:05:41 GMT -5 For unexplained reasons a brand new thread was begun continuing these problems. It can be found here; newworldtech.freeforums.net/thread/462/rerun-scans?page=1&scrollTo=3212
	Inspiron 15 5510 Windows 11 64bit Vivaldi; EDGE; Mailbird; Windows Defender, Windows Firewall, MBAM FREE, SpywareBlaster Inspiron 7591; Windows 10 64bit; Same programs as above.

Admin

Post by possumpaw on Mar 28, 2018 14:06:52 GMT -5

Post by possumpaw on Mar 28, 2018 15:25:55 GMT -5

Post by budgall on Mar 28, 2018 15:30:32 GMT -5

Post by jholland1964 on Mar 28, 2018 15:38:15 GMT -5

Post by possumpaw on Mar 28, 2018 16:20:45 GMT -5

Post by possumpaw on Mar 28, 2018 16:34:03 GMT -5

Post by possumpaw on Mar 28, 2018 16:37:03 GMT -5

Post by jholland1964 on Mar 28, 2018 18:24:37 GMT -5

Post by possumpaw on Mar 28, 2018 19:59:00 GMT -5

Post by jholland1964 on Mar 28, 2018 20:17:16 GMT -5

Post by jholland1964 on Mar 28, 2018 22:34:08 GMT -5

Post by possumpaw on Mar 29, 2018 9:44:45 GMT -5

Post by jholland1964 on Mar 30, 2018 19:05:41 GMT -5