Could my computer be infected?

[Deleted User]

Deleted_User wrote: »

Yes, waddler, it seems to only affect Firefox and not Internet Explorer. It's strange because, this morning, the unwanted adverts don't appear when I click on Firefox or on Internet Explorer. But - even when logged in to the Techie Forum this morning Firefox won't let me 'click' to reply to your post - but it let me click 'thanks.' I logged out and logged in (as at present) to Internet Explorer.

I'm now going to follow your advice as above and Download Roguekiller, following your instructions etc, thank you. Although I won't do anything until you advise I wonder if I should uninstall Firefox and reinstall it?

Crimson

Here is the result, waddler -

RogueKiller V8.6.1 _x64_ [Jun 19 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Christine [Admin rights]
Mode : Scan -- Date : 06/20/2013 11:03:45
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK2565GSX +++++
--- User ---
[MBR] 338565a982b9886267cebc5a507d9731
[BSP] 48aeef1769ddc9929b5900423b368521 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 400 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 821248 | Size: 119001 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 244535296 | Size: 119072 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[0]_S_06202013_110345.txt >>


Crimson

waddler_8

That all looks ok.

Now the ad's have stopped, using firefox, try right clicking the reply button and choose the option "open link in a new tab" - what happens?

[Deleted User]

Success - using the new tab I am able to reply in Firefox. Thank you.

Because this isn't usually a problem does it sound as if it is all related to a virus, or something similar? Your help has worked wonders.

Crimson.

waddler_8

It's just a quirk, I'm sure. I sometimes have a similar problem depending on what site I'm on or what browser I'm using. I wouldn't say it's related to malware.

Are things running ok now?

[Deleted User]

Everything is working really well now, thank you, waddler. Now that I know how to sort the 'quirk' by right clicking etc it is no problem at all. I'm so glad to be rid of all the unpleasant adverts.

I'll need to be extra vigilant in future about what I click on. Wrongly, I now realise, I thought I was really quite well protected.

Thank you again.

Crimson

closed

http://www.macrium.com/reflectfree.aspx

waddler_8

You could try to troubleshoot the issue with firefox if you wanted.

General troubleshooting steps: https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems

Or you could reset firefox. If you were to do this I would recommend reading the article carefully first and backing up any important things like bookmarks etc first.

http://kb.mozillazine.org/Backing_up_and_restoring_bookmarks_-_Firefox#Creating_bookmark_backups
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems


With the adware it can sometimes be a grey area in that in installing the program (usually freeware), part of the trade off may be that it states in the EULA that you agree to the other bundled software and/or adware in return for use of the program freely. There are also varying degrees of "maliciousness" in what the program does. Some security vendors may or may not target the program and/or it's adware based on that.

Add to that malware is constantly changing & looking to avoid being detected by AV's etc.

You just need to be aware and stick to safe surfing practices.

[Deleted User]

waddler_8 wrote: »

You could try to troubleshoot the issue with firefox if you wanted.

General troubleshooting steps: https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems

Or you could reset firefox. If you were to do this I would recommend reading the article carefully first and backing up any important things like bookmarks etc first.

http://kb.mozillazine.org/Backing_up_and_restoring_bookmarks_-_Firefox#Creating_bookmark_backups
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems


With the adware it can sometimes be a grey area in that in installing the program (usually freeware), part of the trade off may be that it states in the EULA that you agree to the other bundled software and/or adware in return for use of the program freely. There are also varying degrees of "maliciousness" in what the program does. Some security vendors may or may not target the program and/or it's adware based on that.

Add to that malware is constantly changing & looking to avoid being detected by AV's etc.

You just need to be aware and stick to safe surfing practices.

I'll take time and read the information, waddler. The useful links are very much appreciated.

Crimson

[Deleted User]

I've reset Firefox successfully saving my bookmarks etc. I've been able to reply by just clicking normally on the icon (without right clicking etc.) so I'm very pleased with the result.

Many thanks indeed.

Crimson

waddler_8

No problem

You can delete DDS and it's logfiles - DDS.txt and attach.txt - and also roguekiller (including the folder RK_Quarantine and the file(s) RKreport[*]_****.txt)

Simply right click and choose delete.

• Right click AdwCleaner.exe & choose "Run as administrator" to run it.
• If AdwCleaner prompts you an update is available, click Cancel
• Click Uninstall.
• Click Yes to the prompt.
• AdwCleaner will close and uninstall itself

Then create a restore point and delete the old ones.

Create a restore point: http://windows.microsoft.com/en-gb/windows7/create-a-restore-point

Delete all but the most recent restore point:

http://windows.microsoft.com/en-gb/windows7/delete-a-restore-point