Alterechoes 0 Report post Posted December 17, 2014 Hello everyone i have serious problems with ads randomly generated by cloudscout in lots of the web pages i visit. In particular i have 3 or 4 ads in my homepage with a red/orange background and when i try to open up new web pages i constantly get many redirects for many things (update flash player, install a windows registry cleaner, and general pop-ups of 2-3 new webpages). but the most weird thing is that i find these ads even in a game client. Thanks a lot for the help and i hope someone can help me fix this problem. Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted December 17, 2014 Hi Alterechoes, Please, to get help with cleaning your computer follow the instructions in the topic Read This Before You Post!. Share this post Link to post Share on other sites
Alterechoes 0 Report post Posted December 17, 2014 Sorry for have not checked that, here are the two files created by the scan. FRST.txt Addition.txt Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted December 17, 2014 It's al-right 1. Please, start the Notepad program. Copy all text that is in the box: Tcpip\..\Interfaces\{5537E6CB-D1DC-44BD-824F-7A202A95E521}: [NameServer] 31.168.224.106,5.135.12.52 Tcpip\..\Interfaces\{6D392312-6822-423C-9F10-C34F95E2E8BA}: [NameServer] 31.168.224.106,5.135.12.52 GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP2\WNt500x64\Sandra.sys [X] S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X] Task: {3EBEA652-F594-41EC-8884-4F115D7E7E4A} - System32\Tasks\{3A7191B0-D033-4AAC-AD06-88891200236D} => pcalua.exe -a "C:\Program Files (x86)\Desk 365\eUninstall.exe" AlternateDataStreams: C:\Windows:7FCB11964DE9893C AlternateDataStreams: C:\ProgramData\TEMP:373E1720 and paste in Notepad. Check that no files have been split on two lines.Save the file as fixlist.txt on the desktop. Exit all programs. Start FRST, please. Click the Fix button. Wait until the tool has finished. The computer will be restarted. It creates a log file, called Fixlog.txt, on the desktop. Please, paste the content of that file in your answer. 2. Please, save AdwCleaner by Xplode on the desktop: https://toolslib.net/downloads/viewdownload/1-adwcleaner/ Turn off all programs, including browsers. Double-click on AdwCleaner to start the program. Click on the Scan button. Wait until the search has finished. Click on the Report button. A report will be displayed, copy its content and paste into your answer. If the report isn't displayed, it exist as C:\AdwCleaner\AdwCleaner[R0].txt. Share this post Link to post Share on other sites
Alterechoes 0 Report post Posted December 17, 2014 and there they are, both the log from FRST and adwcleaner Fixlog.txt AdwCleanerR0.txt Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted December 17, 2014 Good! 1. Please, scan with FRST and attach the new FRST.txt log. 2. Please, scan with Ad-Aware and let me know the result. 3. To get a second opinion, please run an online scan with Eset (easiest with Internet Explorer): http://www.eset.com/onlinescan/ To shorten the scanning time disable your antivirus program while scanning. Select Enable detection of potentially unwanted applications. Click Advanced Settings. Deselect Remove found threats. Select: Scan Archives Scan for potentially unsafe applications Enable Anti-Stealth Technology Click Start. When the scan is finished, click on List of found threats and then Export to text file. Copy the content of the text file and paste its content in your answer. Share this post Link to post Share on other sites
Alterechoes 0 Report post Posted December 17, 2014 and here it is, i'm not attaching any log by eset's scan because it found no problems FRST.txt AdwCleanerR10.txt Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted December 18, 2014 Do you still see ads by cloudscout in Firefox and Internet Explorer? Do you have any other questions or do you only want to know how to uninstall FRST and AdwCleaner? Share this post Link to post Share on other sites
Alterechoes 0 Report post Posted December 18, 2014 Everything is gone so i think i just have to uninstall both softwares Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted December 18, 2014 Good! Please, turn off all programs, including browsers. Double-click on AdwCleaner to start the program. Click on the Uninstall button. Download OTC: http://oldtimer.geekstogo.com/OTC.exe Close all programs. Start OTC program and click the CleanUp! button. If you are asked to reboot, select Yes. If any logs remain on the computer you can remove them. It is very important to keep Windows and all programs updated. An old version of, for example, Flash contains vulnerabilities that makes it easy to infect the computer from a web page. To help you with keeping everything updated you can use the program Secunia Personal Software Inspector (PSI) and http://www.bleepingcomputer.com/tutorials/detect-vulnerable-programs-with-secunia-psi/describes how to install and use the program. Share this post Link to post Share on other sites
Alterechoes 0 Report post Posted December 19, 2014 Thank you very much!! Everything is fine now!! Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted December 19, 2014 You're welcome Share this post Link to post Share on other sites
CeciliaB 470 Report post Posted April 14, 2015 Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact the staff member who was helping you with your issue. Everyone else please begin a New Topic. Thank you ! Share this post Link to post Share on other sites
