How do i get rid of this redirecting virus?

xboxconnect64 · 04 Mar 2015

Being a computer noob, i recently got quite a bit of trojans. i believe i eventually figured out how to delete all but one which gives me the message "The Module C:Users\Lane XD\AppData\Local\Iwlpsoft\nacl64.dll failed to load blah blah blah" on startup as well as shifting me to random websites when using chrome. Most of which are from find-all-you-want.com which is really frustrating and the only methods i could find dont apply to my case. Any help or leads would be highly appreciated.

Jacee · 04 Mar 2015

See this Remove Find-all-you-want.com - Junkware Removal

Let's get rid of the 'adware' first:

Please download AdwCleaner by Xplode and save to your Desktop.
Step 1.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Step 2.
Using AdwCleaner v3: Scan & Clean:
This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

******Post both .txt logs

xboxconnect64 · 05 Mar 2015

# AdwCleaner v4.111 - Logfile created 05/03/2015 at 13:44:23
# Updated 18/02/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Lane XD - MEH-PC
# Running from : C:\Users\Lane XD\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced-System Protector

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Key Found : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}

***** [ Web browsers ] *****

-\\ Internet Explorer v10.0.9200.17229

-\\ Google Chrome v40.0.2214.115

[C:\Users\Guest.Meh-PC\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Guest.Meh-PC\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
*************************

AdwCleaner[R0].txt - [2606 bytes] - [16/09/2014 17:50:49]
AdwCleaner[R1].txt - [2666 bytes] - [16/09/2014 17:56:40]
AdwCleaner[R2].txt - [1587 bytes] - [05/03/2015 11:03:34]
AdwCleaner[R3].txt - [1449 bytes] - [05/03/2015 13:44:23]
AdwCleaner[S0].txt - [2745 bytes] - [16/09/2014 17:58:13]

########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [1567 bytes] ##########

xboxconnect64 · 05 Mar 2015

# AdwCleaner v4.111 - Logfile created 05/03/2015 at 13:49:18
# Updated 18/02/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Lane XD - MEH-PC
# Running from : C:\Users\Lane XD\Downloads\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced-System Protector

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v10.0.9200.17229

-\\ Google Chrome v40.0.2214.115

[C:\Users\Guest.Meh-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Guest.Meh-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [2606 bytes] - [16/09/2014 17:50:49]
AdwCleaner[R1].txt - [2666 bytes] - [16/09/2014 17:56:40]
AdwCleaner[R2].txt - [1587 bytes] - [05/03/2015 11:03:34]
AdwCleaner[R3].txt - [1646 bytes] - [05/03/2015 13:44:23]
AdwCleaner[S0].txt - [2745 bytes] - [16/09/2014 17:58:13]
AdwCleaner[S1].txt - [1585 bytes] - [05/03/2015 13:49:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1644 bytes] ##########
I am still being redirected randomly as we speak :/

Jacee · 05 Mar 2015

Please download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forum and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser! This will also eliminate all desktop shortcuts, so just be aware!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

Important! Manually reboot the machine to ensure a complete clean.

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.

Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

Are you still being re-directed?

xboxconnect64 · 07 Mar 2015

I ran the provided tool as an administrator and it seemed to work correctly but it didnt remove my desktop shortcuts as you said so i continued and ran the .bat file with no luck. should i just reinstall chrome?

ICIT2LOL · 08 Mar 2015

Try this mate
Emsisoft Emergency Kit Download I only ever run the Emergency and Command line scans - see what it comes up with.

There is more as Jacee will tell you too:)

Jacee · 08 Mar 2015

xboxconnect64 said:

I ran the provided tool as an administrator and it seemed to work correctly but it didnt remove my desktop shortcuts as you said so i continued and ran the .bat file with no luck. should i just reinstall chrome?

You may not have noticed, but your desktop icons and task bar were temporarily removed while TFC ran.

Are you still being re-directed?

xboxconnect64 · 08 Mar 2015

Still no dice. Sorry to bother you so much but nothing seems to work although they act as if they did

Jacee · 09 Mar 2015

Let's try Junkware Removal Tool: Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

How do i get rid of this redirecting virus?

How do i get rid of this redirecting virus?

My Logfile after running AdwCleaner

After running the cleaner

Still didnt work :/

unfortunately none has worked