Windows 10: Malware Trouble; Random Command Prompt, Pop-Ups in Chrome.

AustFisch,

Would proceed by removing the 2 files in Quarantine in MBAM, and then following the instructions provided by simrick on Post 11.

 

Hey guys,

So I've finally followed the instructions (DNSUnlocker Ads Removal Guide) of you and simrick by removing what was found in MBAM, and continuing on. I've attached the result logs.

In the post, however, step 24 was a bit confusing as I was unsure what were necessary certificate authorities.

I also have not run the Secunia PSI scan yet.

So far so good though, no pop ups or command prompt runs in a while!

malware3.txt --> Malware results log
hitman_results.log --> Hitman results log
Rkill.txt --> Rkill results

EDIT: and just to clarify, I did not find what step 24 was asking for (www.cloudguard.me) in my certificate authorities.

 

AustFisch,

*Thumbs Great job!!

Not finding the www.cloudguard.me certificate installed by DNSUnlocker is a good sign.

The results of RKill show some missing services, etc., and it has been reported as an RKill bug. No worries there also.

Malwarbytes is fine, and HitmanPro deleted some files and identified a bundle of cookies.

Please press on with simrick's advice on Post 11, to turn off browser syncing and clear all cache and cookies in all browsers and reset them to default.

When done, give us a final update on whether you are having Malware problems, getting any random Command Prompt, or getting any more Pop-Ups.

 

Just a mention here - the 2 hits in MBAM were quarantined by ADWCleaner already.
MBAM logs looks good; HMP log looks good; RKILL log makes me think we might want to run a system file check to fix some bad images in your OS.
Please open an admin command prompt and enter
Code: sfc /scannow[/quote] Notice the space preceding the forward slash.

We're looking for the result "No integrity violations found". If it's anything other than that, please reboot, run it again, rinse and repeat. If you still have no luck with the scan results, please grab a log so we can have a look at the problem(s) in detail:

Open an admin command prompt and type:
Code: findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"[/quote] This will place a text file on your desktop called sfcdetails.txt. (Note: If you have relocated your user files, you may have to manually find this file.) Please upload the file and PM me when that is completed, as I am not around at present.

For the step 24 (certificates):
Sounds to me like that cert will be found on your system since that's the infection we identified. I'd like you to please verify that cert is not found:

Type certmgr in the search box and click on Manage Computer Certificates.






Expand Trusted Root Certification to show the sub-folder Certificates.
In the right pane, scroll all the way down - OpenDNS DNS servers:
Control Panel>Network and Sharing Center>Change Adapter Settings
right-click on each NIC (Network Adapter), select Properties, highlight IPv4, select Properties to verify/change:





It's my understanding that DNSUnlocker may have modified these settings.


Also, please be careful as to what extensions you add to your browsers, as it appeared one of them was a problem.

Cheers!