Windows 10: I have contracted a Virus that shows many Ads

I am now using another computer, by the way, since my primary computer in infected with Malware. I have Windows 10 on my primary computer and Windows 7 Professional on this one.

While downloading a version of Adobe, I clicked on a few windows that I shouldn't have clicked on. This was on Monday, November 9, at about 2:00 pm. Since then, I have been deluged with ads of all kinds; these are full screen ads that even register as a new tab. I also am getting pop-up ads. One of the pop-up ads that comes up in the notification area is "Healer Console."

An example of the full-screen ads is Shopperz. Some of the new software that was downloaded is Wajam, Webshield, One System Care, Browser Air, MPCK, and PCSpeedUp.

Now, when I click on Microsoft Edge, I get www-searching.com as a browser.

A pop-up ad that now appears in the middle of my screen and cannot be deleted (I have to restart) is called "Setup - gentle." It offers adware such as Shopperz and many others.

The constant invasion of ads had made it almost impossible to use the computer.

One new software "NowUSeeIt Player" will not uninstall at all.

I should also add that at one point a very authoritarian woman's voice comes on and informs me that my computer has been infected with a virus and that I should immediately call a telephone number that is provided on the screen.

I have not been able to employ "System Restore" because I did not know that you have to create "System Restore Points" in advance - in anticipation that one might have problems.

I have been able to reach "Malwaretips.com/blogs/remove-adware-popup-ads/". The first step is to "uninstall" any new "suspect" software. I have tried to do this, however, the software that I uninstall keeps coming back.

The second step for "Malwaretips" is to download "ADWCleaner," however, a search offers about a dozen different sites for it.

Does anyone have any suggestions as to how I should proceed?

John C., in the Discussion Forum, has suggested that I might have to do a "Repair Install Windows 10 with an In-Place Upgrade." Does anyone have an opinion on this possibility?

Thanks for your help.

:)

 

Defender shows that I have a Virus but There is no Active Button to "take action" So I cannot eliminate the threat. Please Help! (I did run a Complete Scan)

Patricia,

What is/was the fully qualified name and path to the file deemed to be a virus/trojan ? It will be alot easier to help you remove it once we know
what it is and where its saved into.

`~`

Run <<Disk Cleanup>>and
delete (at ləast) Temporary files,
Offline web pages and Temporary Internet Files as this will reduce scanning times by security software –IE browser
clear your cache, cookies, and history, press Ctrl-Shift-Delete – then
shut down and restart your computer.

Use the System File Checker tool to repair missing or corrupted system files

<<https://support.microsoft.com/en-us/kb/929833>>

After running the Repair, reboot & test.

`~`

You can use Microsoft Safety Scanner to detect and remove this threat. Run a Full scan.<<Microsoft
Safety Scanner>>

Help protect my PC with Windows Defender Offline

<<https://support.microsoft.com/en-us/help/17466/windows-defender-offline-help-protect-my-pc#!/en-us/help/17466/windows-defender-offline-help-protect-my-pc>>

Pləase let us know if this did or didn't help to resolve your problem.

`~`

 

Defender shows that I have a Virus but There is no Active Button to "take action" So I cannot eliminate the threat. Please Help! (I did run a Complete Scan)

Defender shows that I have a Virus but There is no Active Button to "take action" SoI cannot eliminate the threat. Please Help! (I did run a Complete Scan). Please help! I
have Windows 10 Pro 64 bits version 1703

11/20/2017

Thank you!

 

You can download ADWCleaner from here AdwCleaner Download and run it. It will do a scan and may ask you to reboot if it finds anything (sounds like it will).

Then download Malwarebytes from here Malwarebytes | Free Anti-Malware Detection & Removal Software and run a scan using that. You may wish to untick the free trial of Pro version during the install but it doesn't matter either way really.

Hold of the repair install for now - let us know the outcome of these two first.

 

Thanks lx07 for the links to ADWCleaner and Malwarebytes.org.

The ADWCleaner deleted 28 files, and, it appears also many small background files. But some ads still came up; however, after I downloaded and ran Malwarebytes, all of the ads except one disappeared (see below).

Here is a list of the lingering items:

1/ A window named "Healer Console" appears in the lower right "notification" corner. However, when I cancel it, it doesn't come back. This window only shows up with Microsoft Edge, but, again, when I click on Microsoft Edge, www-searching.com opens up as the browser. With Internet Explorer the "Healer Console" ad does not show up.

2/ The Microsoft Edge browser shows as www-searching.com. It didn't do this prior to the infection.

3/ The software "NowUSeeIt Player" cannot be deleted. A message comes up that reads: "Do you want this app to update software on your PC?" Whatever you click on: yes or no, nothing happens. The program name for this software is: 221a3c.msi

4/ An ad for "PC Speedup Pro Repair," which seems to be connected to the www-searching.com browser, opens up unsolicited; however, not when I use Internet Explorer.

Question: Does the ADW Cleaner software remain on the computer? I see that the Malwarebytes does remain with an icon on the Desktop.

Thanks again to lx07 and to John C. for pursuing this problem to a successful conclusion.

 

Good advice from lx07.

Recommend doing a System Restore to a point prior to the issue, then running Malwarebytes and AdW Cleaner again to be safe.

Not sure if AdW Cleaner remains on computer in some form, but I always download again and use the uninstall button.

 

Thanks for the tips. Unfortunately, I did not set any "System Restore Points" at all. For previous editions of Windows, one did not have to set (or have the computer set) Restore Points; after a virus infection, you could set a date back to which you wanted to restore your system. I'll have to make sure that I set regular Restore Points for the future - or have Windows 10 do it automatically.

 

ADWcleaner remains on your computer but it isn't installed. To run it just double click on it again (you can move it from downloads and put it wherever you like). It stores all its logs in a new folder on your PC called C:\ADWCleaner

Please run it again and upload the log file generated (click on scan, then clean). When it reboots notepad should open with a report of what it has done. It will be called something like "AdwCleaner[C2]" but the number may be different.

Please save this document to your desktop and then upload it with your next post as described here Screenshots and Files - Upload and Post in Ten Forums - Windows 10 Forums

 

In addition to the above.
Win+X -> Programs and Features
Check if any add-on toolbar, search toolbar, bloatware were installed then uninstall them.

 

For lx07: Thanks for the Follow-up:

The browser www-searching.com still opens up when I click on Microsoft Edge. An ad appears in the middle of the page by "************" If I click on "No," a full-screen ad opens up for software to tweek Windows 10. Also the "Healer Console" ad still appears when I click on Microsoft Edge. Interesting that it will not let me type the name of "r e i m a g e.com" That's what all of the stars are above. *********

I ran the ADWCleaner Scan and Cleaning: It generated a LogFile; I tried to use "insert image" to upload the file, but it would not function. Therefore, I have copied the file.

# AdwCleaner v5.021 - Logfile created 15/11/2015 at 17:15:42
# Updated 14/11/2015 by Xplode
# Database : 2015-11-13.3 [Server]
# Operating system : Windows 10 Home (x86)
# Username : User - USER-PC
# Running from : C:\Users\User\Downloads\AdwCleaner.exe
# Option : Cleaning
# Support : Forum - ToolsLib

***** [ Services ] *****

[-] Service Deleted : bsdriver

***** [ Folders ] *****


***** [ Files ] *****

[-] File Deleted : C:\WINDOWS\system32\drivers\bsdriver.sys
[-] File Deleted : C:\WINDOWS\system32\drivers\cherimoya.sys

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9563BC59-9556-4805-8CD4-886781779D8D}
[-] Key Deleted : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wek yb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www-searching.com
[-] Key Deleted : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wek yb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www-searching.com

***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [1359 bytes] ##########

 

Thanks for the tip. It appears that there were no add-on toolbars, search toolbars, or bloatware installed.

 

Another place you might want to check. Turn on the "Show Hidden Files" & uncheck "Hide protected operating..." in Folder Options and look at the root folder of your HD's to see if there's an autorun.inf

 

All of this is quite new to me. Please remember that I am a rookie. Having said that, let me say that I found the "File Explorer Option" by clicking on "Start" then "Search" and searching for "Show hidden files." I found the listing: "Hide Protected Operating System Files."

Now, at this point, I can guess that "HD" stands for "Hard Disk," but I don't know that for sure. Additionally, I don't know what a root folder is or where to find it. If there is an "autorun.inf," what does this mean?

I appreciate your help, and I am definitely learning a lot, but please understand that you are "light-years" ahead of me.

 

@Writer
You might want to download and run RKILL.
This program scans your system and kills suspect processes so you can use your computer. Everything it does is undone by a reboot. Once the scan is finished, it puts a text file on your desktop. Please upload that file here and we'll have a look at it.

It's quite possible that Edge will have to be reset. Other browsers reset very easily, but Edge is a different story.

Try Edge Settings>Advanced Settings>Open Proxy Settings and see if there is anything in there. If so, get rid of it.

Please check your installed programs and see if it is listed. If so, please try uninstalling from there.

Check for proxys, as I show above.

Again, please check your installed programs and see if it is listed. If so, please try uninstalling from there.

Here as well, please check your installed programs and see if it is listed. If so, please try uninstalling from there.

ADWCleaner does not "install" per se, it merely stays there, unless you delete it. Malwarebytes, OTOH, does install.

Unfortunately, MS turn off system restore every time a major update comes through. IMO, whoever made that decision ought to be fired.

HD or HDD = Hard Drive
System root = C:\ (usually "C:" - the root of the drive your operating system is installed on) If your OS (Operating System) is installed on the D drive, then your system root would be D:\.
autorun.inf would be the name of a file that runs automatically, found in your system root, where one would not belong normally.

Open up a different browser like Firefox or Internet Explorer, and run an ESET Online Scan:
Click on the green button to download the installer.
Save the file (the example is using Firefox).
Now, run the file.
(I will post more screenshots in the next message.)

 

Wow! I just noticed that you added a lot of information to your original post. Thank you very much. I have been working on this for several hours today, and my eyes are getting bleary. I'll follow up on your suggestions tomorrow.

Let me just say that "Healer Console" has stopped popping up. The software "NowUSeeIt Player" is listed with my programs, but it will not uninstall. When I try uninstalling it, the following message comes up: "Do you want this app to update software on your computer?" No matter if you answer "Yes" or "No" it does not uninstall.

I have run ADWCleaner and Malwarebytes Antimalware, and almost everything has returned to normal. One matter, which appears to be minor, is that when I open Microsoft Edge, www-searching.com comes up as the browser. Along with www-searching.com there is an ad in the middle of the page for Reimage Repair. When I click on "NO," a full-screen ad opens up offering a Download for Windows 10. When I delete it, it asks me "if I am sure I want to leave this page?" After I click on "Yes," the full-screen ad disappears and doesn't come back. But it reappears every time I open up Edge.

This is the only small problem that remains from an invasion of ads after my computer was infected.

As you suggest, I might have to "reset" Edge. In that regard, could you explain to me how you arrive at the "Screen Shot" that you have in your post? The one for "Edge Settings." I haven't been able to find it.

I'll try to find it again tomorrow, Monday, November 16.

Thanks again for your input. Thanks also for explaining the points that I didn't understand from "topgundcp's" post.