i need help please!

Hello,

Can you share the logfile please ? Usually from C:\AdwCleaner\AdwCleaner[Sxx].txt

Thanks,

here is the first scan :  

# AdwCleaner v6.020 - Logfile created 24/09/2016 at 19:05:42 # Updated on 14/09/2016 by ToolsLib # Database : 2016-09-23.1 [Server] # Operating System : Windows 7 Ultimate Service Pack 1 (X64) # Username : MARK - MARK-PC # Running from : C:\Users\MARK\Downloads\Programs\adwcleaner_6.020.exe # Mode: Clean # Support : https://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com [#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted :: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [949 Bytes] - [24/09/2016 19:05:42] C:\AdwCleaner\AdwCleaner[S0].txt - [1287 Bytes] - [24/09/2016 18:59:22]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1094 Bytes] ##########

and here is the second scan :

# AdwCleaner v6.020 - Logfile created 24/09/2016 at 18:59:22 # Updated on 14/09/2016 by ToolsLib # Database : 2016-09-23.1 [Server] # Operating System : Windows 7 Ultimate Service Pack 1 (X64) # Username : MARK - MARK-PC # Running from : C:\Users\MARK\Downloads\Programs\adwcleaner_6.020.exe # Mode: Scan # Support : https://toolslib.net/forum

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious keys found.

***** [ Shortcuts ] *****

No infected shortcut found.

***** [ Scheduled Tasks ] *****

No malicious task found.

***** [ Registry ] *****

Key Found:  HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com Key Found:  [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com

***** [ Web browsers ] *****

No malicious Firefox based browser items found. No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [1131 Bytes] - [24/09/2016 18:59:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1204 Bytes] ##########

Hello,

Thanks !

Can you do the following to get additional informations ?

• Download FRST
• Right-click on the file -> "Execute as Administrator"
• Click on the "Scan" button
• The logfile is saved as FRST.txt , and additional informations are in Addition.txt.
• Please host them on Up2Share and share the generated link.

Best regards,

ok i did the scan and the FRST made 2 text files

FRST.txt :

https://up2sha.re/file?f=EzG7YkY0aaD3

Addtion.txt :

https://up2sha.re/file?f=GYgoQ19WCKUU

what i have to do now?

Hello,

Thanks ! I'm looking at it, and keep you informed quickly.

Hello,

Thanks. The tab is shown in Internet Explorer only ?

Ok.

Do you have the url shown in the tab ?

• Download ZHPDiag from Nicolas on his website
• Then run it with administrator's rights (with right click)
• Then upload the log file on up2share (you will find it on your desktop, just drop the file on the upload zone)
• Then post the link in your reply

the tab that always shown is :

hxxp://iraqiads1.blogspot.com/

the log text file :

https://up2sha.re/file?f=5OhAuDaOio3l

sorry for late in replying 

Thanks.

• Download RogueKiller here
• Execute the file "setup.exe" as Administrator (right-click on the file -> Execute as Administrator"
• The pre-scan will occur, please wait until it ends.
• Then click on [Scan] on the right hand corner. Wait until the scan finish.
• Finally, host the generated logfile on Up2Sha.re and copy/paste here the provided link.

here is the log file :

https://up2sha.re/file?f=zSsSyUKRhJM7

Hello,

Sorry for the delay. Please relaunch Roguekiller and do a [clean]. Then, please share the logfile as above.

Best regards,