Infected by mail.ru virus

cookies1 · 23 Jan 2017

Hi,

2 days ago I ran a infected Russian .exe file to download a intro template from "Frogges" Youtube channel with mediadisk.net website. But with that I downloaded some unwanted programs to my computer. The virus opens an advertising tab on my Google Chrome half-hourly. Firstly, there is "world-direct.ru/steepm" or "puklisi.ru" or "pine-apples.org/poldm" or "hfullinform.ru/alainm" address, then directs me various advertising sites. I scanned my computer with AVG, Kaspersky, Bitdefender, Avast and Malwarebytes programs. Also I used AdwCleaner. I reinstalled Google Chrome. But there is no successful result. I think antivirus programs can't see that thing as a virus. Then I downloaded Zemana Antimalware and scanned my computer. It found some infected files on my computer and deleted them. But there is no result again.
Here is scan results with Zemana Antimalware: Imgur: The most awesome images on the Internet
How can I delete that thing?

Thanks for your helps.

cottonball · 23 Jan 2017

Would you kindly attach the Zemana results?

Can't read the link provided!

Thanks.

cookies1 · 23 Jan 2017

Here you are. It's Turkish. If you want, I can translate words to English.

prikker · 23 Jan 2017

Have you tried this program: Adware Removal Tool Download - Tech Support All

cottonball · 23 Jan 2017

cookies1,

When Zemana AntiMalware is finished it displays a list of all the malware found.

Did you click on Next to remove the malicious files from your computer?

cookies1 · 23 Jan 2017

I have tried Adware Removal Tool, but there is no result again.
No, When Zemana is finished, I selected "delete" for hfullinform, pineapples, wd-client, not quarantine. For first and second threat I didn't remember what I select. But probably they weren't "Onar" ("repair" in English).
Sorry for my bad English.

prikker · 23 Jan 2017

When you uninstalled Chrome did you delete your profile to? Uninstall with e.g. Revo uninstaller?

cookies1 · 23 Jan 2017

Yes, I completely uninstalled Chrome with Revo Unistaller. Then I tried it with no Google account connection. But there was again same problem. So I think the virus isn't related about Chrome account or profil.

cottonball · 23 Jan 2017

@prikker

There are recommendations about not using this tool in very reputable forums.

cookies1,

Your English is just fine. You would not want me trying to speak Turkish!!

Try the additional suggestions, starting with: What if mail.ru hijacker remains?
How to remove Mail.ru (Chrome, Firefox, IE, Edge)

Also, please download SystemLook from one of the links below and save to the Desktop.

32 bit: http://jpshortstuff.247fixes.com/SystemLook.exe
64 bit: http://jpshortstuff.247fixes.com/SystemLook_x64.exe

Right-click the downloaded file and select: Run as Administartor
Double-click SystemLook.exe to run it.

At the SystemLook interface, in the blank square area, copy and Paste the content of the following code box:

Code:

:filefind
mail.ru
*mail.ru* 
:folderfind
mail.ru
*mail.ru* 
:regfind
mail.ru

Now, click the Look button to start the scan.

When finished, a notepad window opens with the results of the scan.

Please attach the SystemLook-Notepad report in your reply.

Note: The scan may take a while depending on the number of files in the system and how fast your computer can perform the task.

prikker · 23 Jan 2017

@cottonball: What tool do you mean and why?