how to uninstall directx redist ads?

cottonball · 03 Sep 2013

...i don't see popups

That is good, however, we want to make sure. Too many things are showing in Malwarebytes...

Please run Malwarebytes Anti-Malware once again, since it shows No action taken on all the entries!!

Click on the Scan button.

When the Malwarebytes scan is completed, click on: Show Results
When presented with a screen showing the malware detected, make sure everything is checked, and click on: Remove Selected

When removal is completed, a report opens in Notepad.

Please copy/paste the entire contents of the MBAM report in your reply

AdwCleaner:

At the program console, did you click on: Delete
Did the computer reboot after it was done?

If it is No, on the above, please run it again, using: Delete

Please post the AdwCleaner report in your reply.

Also use the Junkware Removal Tool Download
Save to the Desktop.

Make sure you temporarily disable your AntiVirus, Firewall, and any other AntiSpyware applications.
These programs may interfere with the running of JRT.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

Right-click JRT.exe and select: Run as Administrator
The tool opens and starts scanning the system. Please be patient as this can take a while...

When done, a report, JRT.txt is saved on the Desktop.

Please post the contents of JRT.txt in your reply.

la321 · 03 Sep 2013

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.09.02.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
User :: USER-PC [administrator]

9/3/2013 11:28:54 AM
mbam-log-2013-09-03 (11-28-54).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 468172
Time elapsed: 56 minute(s), 4 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 28
C:\AdwCleaner\Quarantine\C\Program Files (x86)\lucky leap\luckyleapBHO.dll.vir (PUP.Optional.LuckyLeap.A) -> Quarantined and deleted successfully.
C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll.vir (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart.exe.vir (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart64.exe.vi r (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabWrap.dll.vir (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabWrap64.dll.vir (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\AdwCleaner\Quarantine\C\Users\User\AppData\Roaming\DefaultTab\DefaultTab\update.exe.vir (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\Backup\Backup\B yakuya\Downloads\4shared_Desktop_3.3.5.exe (PUP.Optional.4Squared) -> Quarantined and deleted successfully.
C:\Backup\Backup\B yakuya\Downloads\DTLite4413-0173.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Conduit\CT3289847\WhiteSmoke_NewAutoUpdateHelper.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\97HFDPST\statisticsstub[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0DU2KNY\checktbexist[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\SwvUpdater\Updater.exe (PUP.Optional.Amonetize) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\ToolbarHelper.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\ct3289847\ctbe.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\ct3289847\ffLogic.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\ct3289847\ieLogic.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\ct3289847\spff.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\ct3289847\statisticsStub.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\DIQM\Setup_151\setup__120.exe (PUP.Optional.Amonetize) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\DIQM\Setup_151\software\OptimizerPro.exe (PUP.Optional.OptimizePro.A) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Local\Temp\DIQM\Setup_151\software\Setup__120_i21991996.exe (PUP.Optional.Amonetize) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart.exe (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart64.exe (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabWrap.dll (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\Backup\User\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabWrap64.dll (PUP.Optional.DefaultTab) -> Quarantined and deleted successfully.
C:\Backup\Windows\Temp\Optimizer_Pro.exe (PUP.Optional.OptimizerPro.A) -> Quarantined and deleted successfully.

(end)

la321 · 03 Sep 2013

yes i did click on delete for adwcleaner it restarted computer luckyleap was deleted

la321 · 03 Sep 2013

here is the jrt

la321 · 03 Sep 2013

these are the files that are showing when i downloaded the fake directx mar2008 Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting http://tinypic.com/r/29oojgz/5

la321 · 03 Sep 2013

i deleted the files out of recycle bin and off desktop

cottonball · 03 Sep 2013

Looks as if running all the programs suggested did the trick.

To make sure the malware is all gone, would you mind running the following:

Download RogueKiller:
http://tigzy.geekstogo.com/roguekiller.php
Select the version that applies to the system.
Save to the Desktop.

After closing all windows and browsers, right-click the downloaded RogueKiller file and select: Run as Administrator
At the program console, wait for the Prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the drive: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.

While we are at it, let’s check your Security status with the following...
Download Security Check:
http://screen317.spywareinfoforum.org/
Save to your Desktop.
Double-click: SecurityCheck.exe
Follow the onscreen instructions inside the black box.
When done, a Notepad report opens automatically, called: checkup.txt

Please post the checkup.txt in your reply.
(Please do not take any corrective actions!)

la321 · 03 Sep 2013

Results of screen317's Security Check version 0.99.73
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (23.0.1)
````````Process Check: objlist.exe by Laurent````````
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

andrew129260 · 03 Sep 2013

I would highly suggest turning on UAC and setting it to the highest setting. Its an extra click, but worth it by protecting you from threats and malware.

User Account Control - UAC - Change Notification Settings

Also, uninstall adobe reader and install the newest version of adobe reader.

cottonball · 03 Sep 2013

Adobe Reader out of Date!

latest version:
Adobe - Adobe Reader download - All versions
(Uncheck the following: Yes, install McAfee Security Scan Plus)

When done, go to Start > Control Panel > Programs and Features > Uninstall List
Look for, and remove any older Adobe Reader versions.

Otherwise, looking good!!

Let's wrap up and remove the following tools and their reports, which are no longer needed:

To remove the FRST Quarantine...
Remove any fixlist.txt from the Desktop.

Open Notepad (Start > All Programs > Accessories > Notepad)
Copy/paste all the contents of the quote box below to Notepad (do not copy the word 'Quote').
Save it on the Desktop as: fixlist.txt

start
DeleteQuarantine:
end

Run FRST from the Desktop again, press the Fix button once.
When done, you can delete the fixlog produced, any leftover fixlist, and the FRST icon from the Desktop (if still there).

Next, remove the following tools and their reports, since these tools are updated frequently, and it is best to have a new copy:
RogueKiller
AdwCleaner: run the program, and press: Uninstall
Junkware Removal Tool
Security Check

Keep Malwarebytes Anti-Malware, and use it regularly.
If you have USB pendrives or SD cards, connect them to someone else's computer, and then connect them back to your computer! The Perform Full Scan has the option of selecting which drives you want to scan, and includes the removable drives.

If you are no longer having malware/adware problems, you are good to go!
Thanks for following all the instructions and providing the reports!!

Have a great week, la321!!