Infected by mail.ru virus

GregoryP · 27 Jan 2017

cookies1 said:

Hi,

2 days ago I ran a infected Russian .exe file to download a intro template from "Frogges" Youtube channel with mediadisk.net website. But with that I downloaded some unwanted programs to my computer. The virus opens an advertising tab on my Google Chrome half-hourly. Firstly, there is "world-direct.ru/steepm" or "puklisi.ru" or "pine-apples.org/poldm" or "hfullinform.ru/alainm" address, then directs me various advertising sites. I scanned my computer with AVG, Kaspersky, Bitdefender, Avast and Malwarebytes programs. Also I used AdwCleaner. I reinstalled Google Chrome. But there is no successful result. I think antivirus programs can't see that thing as a virus. Then I downloaded Zemana Antimalware and scanned my computer. It found some infected files on my computer and deleted them. But there is no result again.
Here is scan results with Zemana Antimalware: Imgur: The most awesome images on the Internet
How can I delete that thing?

Thanks for your helps.

send original file to Kaspersky, avast etc. after couple a days they're found solution how to delete it.

cookies1 · 30 Jan 2017

Hello,

I have attached the results.
D\INDIRILENLER file is my Downloads file from Chrome. When I download a file in Chrome, it goes to D\INDIRILENLER file. I didn't think there is no different C: or D:, so I ran FRST64.exe from D\INDIRILENLER. C is SSD for Windows, D is HDD for storage.
For fixlist.txt, I copied FRST64 to Desktop and ran from there.

Thanks.

cottonball · 30 Jan 2017

cookies1,

How is the system running?

Also, please download CKScanner:
http://downloads.malwareremoval.com/CKScanner.exe
Save the file to the Desktop.

To run the program, right-Click CKScanner.exe and select: Run as administrator

Next, click: Search For Files

When done, click: Save List To File
A message verifies the file saved.

A log (CKFiles.txt) is created on the Desktop.
Press: Exit

Then, attach the contents of CKFiles.txt in your reply.

Thanks!

cookies1 · 31 Jan 2017

I have attached the results of ckfiles.txt
I think my internet is faster now.
I'm trying to do what you say. Is there any residual file of this virus in my PC now?

Thanks.

cottonball · 31 Jan 2017

cookies1,

We got rid of some items of concern with the FRST fixlist. Didn't see any additional malware, and the CKScanner came out clean. That is good! It scans for cracked software, etc., which you do not want.

The program that follows checks for the installed and running security programs on your computer.
We need to make sure you are good to go.

Please download Security Check:
SecurityCheck Download
Save the downloaded file to the Desktop.

Right-click SecurityCheck.exe and select: Run as Administrator
Follow the onscreen instructions.

When the program is done, a Notepad document opens, called: checkup.txt

Please attach the contents of checkup.txt in your reply.

luarpc · 31 Jan 2017

Do a System Restore to restore Windows back to an earlier point in time. I had the same problem on a laptop of a friend, and i can't get rid of Russian mail.ru virus, malware, adware... or whatever. The only solution was to restore Windows to an earlier point, before the mail.ru infection.

System Restore Windows 10

cottonball · 01 Feb 2017

luarpc,

As mentioned before, mail.ru may implement Group Policy changes.
If so, until those are removed, anyone will get nowhere in a hurry.

cookies1 · 01 Feb 2017

I have attached the results of checkup.txt
I thought to do a System Restore. But when I click to System Restore, I remembered I deactived it 1 year ago. So there was no System Restore point, I couldn't do a System Restore. Even so, if it was possible I can't trust it. I think there can be some relidual files in my PC again.
Thanks.

cottonball · 01 Feb 2017

cookies1,

Java version 32-bit out of Date!
Please check for Java versions on your computer, and remove them:
https://www.java.com/en/download/uninstalltool.jsp

I think there can be some residual files in my PC again.

Can you provide some file names, and their full address?
Example: C:\Users\Home\AppData\name of file, etc.

If not, what makes you think you are still infected?
Please explain.

Thanks!

cookies1 · 01 Feb 2017

I reinstalled Java, now its version is 64-bit. We have deleted and cleaned a lot of things. So I think I shouldn't think my PC is infected now. I thought silly about residual files, sorry for that. This infected virus disrupted my psychology. Anyway, is there any step to clean or do something else for harmful file or stuff in my PC?

Thanks. :)