Tweet
[HEADING=1]Fix result of Farbar Recovery Scan Tool (x64) Version: 26-09-2017 01
Ran by Tom (29-09-2017 16:41:25) Run:1
Running from D:\Downloads (D)
Loaded Profiles: Tom (Available Profiles: Tom)
Boot Mode: Normal[/HEADING]
fixlist content:
Start
CreateRestorePoint:
Closeprocesses:
Emptytemp:
RemoveProxy:
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001...\Run: [BingSvc] => C:\Users\Tom\AppData\Local\Microsoft\BingSvc\BingS vc.exe [144008 2015-11-05] (� 2015 Microsoft Corporation)
AutoConfigURL: [S-1-5-21-2235556512-3620655794-2756196336-1001] => hxxp://accessunlimitedweb.com/wpad.dat?eba26c9b7e75eb6c2021304adf1dc75435690757
ManualProxies: 0hxxp://accessunlimitedweb.com/wpad.dat?eba26c9b7e75eb6c2021304adf1dc75435690757
CHR DefaultSearchURL: Default → hxxp://www.bing.com/search?FORM=__PARAM__DF&PC=PARAM&q={searchTerms}
CHR DefaultSearchKeyword: Default → bing.com
CHR DefaultSuggestURL: Default → hxxp://www.bing.com/osjson.aspx?FORM=__PARAM__DF&PC=PARAM&query={searchTerms}
CHR Extension: (Qmee) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbaanpgkpkoamihninlcegnjcl cpibde [2017-09-24]
CHR Extension: (Chrome Media Router) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2017-09-24]
R1 MpKsl7aecbb60; C:\ProgramData\Microsoft\Windows Defender\Definition Updates{0BA0659A-5067-4713-9DE0-A817833F65C5}\MpKsl7aecbb60.sys [44928 2017-09-24] (Microsoft Corporation)
C:\ProgramData\Microsoft\Windows Defender\Definition Updates{0BA0659A-5067-4713-9DE0-A817833F65C5}\MpKsl7aecbb60.sys
Zip: C:\WINDOWS\Minidump
C:\Users\Tom\AppData\Local\Temp_is365B.exe
C:\Users\Tom\AppData\Local\Temp_is6467.exe
ContextMenuHandlers5: [igfxcui] → {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => → No File
ContextMenuHandlers5: [igfxDTCM] → {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => → No File
CustomCLSID: HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 → C:\Users\Tom\AppData\Local\Microsoft\OneDrive\17.3 .6998.0830\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 → C:\Users\Tom\AppData\Local\Microsoft\OneDrive\17.3 .6998.0830\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 → C:\Users\Tom\AppData\Local\Microsoft\OneDrive\17.3 .6998.0830\amd64\FileSyncShell64.dll => No File
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state On
CMD: ipconfig /flushdns
reboot:
end
Restore point was successfully created.
Processes closed successfully.
========= RemoveProxy: =========
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVers ion\Internet Settings\Connections\DefaultConnectionSettings => value removed successfully
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVers ion\Internet Settings\Connections\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\SavedLegacySettings => value removed successfully
========= End of RemoveProxy: =========
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\Software\Microsoft\Windows\CurrentVersion\Run \BingSvc => value removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\AutoConfigURL => value not found.
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSearchKeyword => removed successfully
Chrome DefaultSuggestURL => removed successfully
CHR Extension: (Qmee) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbaanpgkpkoamihninlcegnjcl cpibde [2017-09-24] => Error: No automatic fix found for this entry.
CHR Extension: (Chrome Media Router) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2017-09-24] => Error: No automatic fix found for this entry.
MpKsl7aecbb60 => service not found.
“C:\ProgramData\Microsoft\Windows Defender\Definition Updates{0BA0659A-5067-4713-9DE0-A817833F65C5}\MpKsl7aecbb60.sys” => not found.
================== Zip: ===================
C:\WINDOWS\Minidump → copied successfully to C:\Users\Tom\Desktop\29.09.2017_16.41.33.zip
=========== Zip: End ===========
C:\Users\Tom\AppData\Local\Temp_is365B.exe => moved successfully
C:\Users\Tom\AppData\Local\Temp_is6467.exe => moved successfully
HKLM\Software\Classes\Directory\Background\ShellEx \ContextMenuHandlers\igfxcui => key removed successfully
HKLM\Software\Classes\CLSID{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => key not found.
HKLM\Software\Classes\Directory\Background\ShellEx \ContextMenuHandlers\igfxDTCM => key removed successfully
HKLM\Software\Classes\CLSID{9B5F5829-A529-4B12-814A-E81BCB8D93FC} => key not found.
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => key removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => key removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => key removed successfully
C:\WINDOWS\system32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
========= netsh advfirewall reset =========
Ok.
========= End of CMD: =========
========= netsh advfirewall set allprofiles state On =========
Ok.
========= End of CMD: =========
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
=========== EmptyTemp: ==========
BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 86344007 B
Java, Flash, Steam htmlcache => 346023371 B
Windows/system/drivers => 18217506 B
Edge => 37261021 B
Chrome => 382816087 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 4830 B
NetworkService => 733004 B
Tom => 1247380473 B
RecycleBin => 0 B
EmptyTemp: => 2 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 16:42:29 ====
My C Drive:
Zemana AntiMalware 2.74.2.150 (Installed)
Scan Result : Completed
Scan Date : 2017/9/29
Operating System : Windows 10 64-bit
Processor : 4X Intel(R) Core™ i3-6100 CPU @ 3.70GHz
BIOS Mode : Legacy
CUID : 122A28AEB59F31361D0402
Scan Type : Custom Scan
Duration : 16m 56s
Scanned Objects : 441201
Detected Objects : 6
Excluded Objects : 0
Read Level : Normal
Auto Upload : Enabled
Detect All Extensions : Disabled
Scan Documents : Disabled
Domain Info : WORKGROUP,0,2
[HEADING=1]Detected Objects[/HEADING]
ld.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.exe
ld.bfd.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.bfd.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.bfd.exe
avr-ld.bfd.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.bfd.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.bfd.exe
avr-ld.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.exe
INK.exe
Status : Scanned
Object : %programfiles%\steam\steamapps\common\ink\ink.exe
MD5 : 53D3FFB4D83C8DE75185527DC235D2F8
Publisher : -
Size : 14396928
Version : 1.0.0.1
Detection : Heur.Malicious!Pc
Cleaning Action : Quarantine
Related Objects :
File - %programfiles%\steam\steamapps\common\ink\ink.exe
winwb.exe
Status : Scanned
Object : %homedrive%\adwcleaner\quarantine\fraqbc8wsa\5.5.6 310.18878\winwb.exe
MD5 : ED2F7A31369BC899B32002A03BDDACFA
Publisher : Web Bar Media
Size : 197352
Version : 5.5.6310.18878
Detection : Adware:Win32/WebBar!Ep
Cleaning Action : Quarantine
Related Objects :
File - %homedrive%\adwcleaner\quarantine\fraqbc8wsa\5.5.6 310.18878\winwb.exe
[HEADING=1]Cleaning Result[/HEADING]
Cleaned : 6
Reported as safe : 0
Failed : 0
My D Drive:
Zemana AntiMalware 2.74.2.150 (Installed)
Scan Result : Completed
Scan Date : 2017/9/29
Operating System : Windows 10 64-bit
Processor : 4X Intel(R) Core™ i3-6100 CPU @ 3.70GHz
BIOS Mode : Legacy
CUID : 122A28AEB59F31361D0402
Scan Type : Custom Scan
Duration : 4m 52s
Scanned Objects : 27554
Detected Objects : 4
Excluded Objects : 0
Read Level : Normal
Auto Upload : Enabled
Detect All Extensions : Disabled
Scan Documents : Disabled
Domain Info : WORKGROUP,0,2
[HEADING=1]Detected Objects[/HEADING]
ld.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.exe
ld.bfd.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.bfd.ex e
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.bfd.ex e
avr-ld.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.exe
avr-ld.bfd.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.bfd.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.bfd.exe
[HEADING=1]Cleaning Result[/HEADING]
Cleaned : 4
Reported as safe : 0
Failed : 0
I dont use anything besides chrome so i dont know if the issue is there
ive done everything apart from the ads fix as it appears to have gone but if it is still here then i will do that and give you the report
If i have not seen anything to do with the adware in a couple of days then i will update you
Ran by Tom (29-09-2017 16:41:25) Run:1
Running from D:\Downloads (D)
Loaded Profiles: Tom (Available Profiles: Tom)
Boot Mode: Normal[/HEADING]
fixlist content:
Start
CreateRestorePoint:
Closeprocesses:
Emptytemp:
RemoveProxy:
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001...\Run: [BingSvc] => C:\Users\Tom\AppData\Local\Microsoft\BingSvc\BingS vc.exe [144008 2015-11-05] (� 2015 Microsoft Corporation)
AutoConfigURL: [S-1-5-21-2235556512-3620655794-2756196336-1001] => hxxp://accessunlimitedweb.com/wpad.dat?eba26c9b7e75eb6c2021304adf1dc75435690757
ManualProxies: 0hxxp://accessunlimitedweb.com/wpad.dat?eba26c9b7e75eb6c2021304adf1dc75435690757
CHR DefaultSearchURL: Default → hxxp://www.bing.com/search?FORM=__PARAM__DF&PC=PARAM&q={searchTerms}
CHR DefaultSearchKeyword: Default → bing.com
CHR DefaultSuggestURL: Default → hxxp://www.bing.com/osjson.aspx?FORM=__PARAM__DF&PC=PARAM&query={searchTerms}
CHR Extension: (Qmee) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbaanpgkpkoamihninlcegnjcl cpibde [2017-09-24]
CHR Extension: (Chrome Media Router) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2017-09-24]
R1 MpKsl7aecbb60; C:\ProgramData\Microsoft\Windows Defender\Definition Updates{0BA0659A-5067-4713-9DE0-A817833F65C5}\MpKsl7aecbb60.sys [44928 2017-09-24] (Microsoft Corporation)
C:\ProgramData\Microsoft\Windows Defender\Definition Updates{0BA0659A-5067-4713-9DE0-A817833F65C5}\MpKsl7aecbb60.sys
Zip: C:\WINDOWS\Minidump
C:\Users\Tom\AppData\Local\Temp_is365B.exe
C:\Users\Tom\AppData\Local\Temp_is6467.exe
ContextMenuHandlers5: [igfxcui] → {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => → No File
ContextMenuHandlers5: [igfxDTCM] → {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => → No File
CustomCLSID: HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 → C:\Users\Tom\AppData\Local\Microsoft\OneDrive\17.3 .6998.0830\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 → C:\Users\Tom\AppData\Local\Microsoft\OneDrive\17.3 .6998.0830\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 → C:\Users\Tom\AppData\Local\Microsoft\OneDrive\17.3 .6998.0830\amd64\FileSyncShell64.dll => No File
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state On
CMD: ipconfig /flushdns
reboot:
end
Restore point was successfully created.
Processes closed successfully.
========= RemoveProxy: =========
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVers ion\Internet Settings\Connections\DefaultConnectionSettings => value removed successfully
HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVers ion\Internet Settings\Connections\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\SavedLegacySettings => value removed successfully
========= End of RemoveProxy: =========
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\Software\Microsoft\Windows\CurrentVersion\Run \BingSvc => value removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\AutoConfigURL => value not found.
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSearchKeyword => removed successfully
Chrome DefaultSuggestURL => removed successfully
CHR Extension: (Qmee) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbaanpgkpkoamihninlcegnjcl cpibde [2017-09-24] => Error: No automatic fix found for this entry.
CHR Extension: (Chrome Media Router) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2017-09-24] => Error: No automatic fix found for this entry.
MpKsl7aecbb60 => service not found.
“C:\ProgramData\Microsoft\Windows Defender\Definition Updates{0BA0659A-5067-4713-9DE0-A817833F65C5}\MpKsl7aecbb60.sys” => not found.
================== Zip: ===================
C:\WINDOWS\Minidump → copied successfully to C:\Users\Tom\Desktop\29.09.2017_16.41.33.zip
=========== Zip: End ===========
C:\Users\Tom\AppData\Local\Temp_is365B.exe => moved successfully
C:\Users\Tom\AppData\Local\Temp_is6467.exe => moved successfully
HKLM\Software\Classes\Directory\Background\ShellEx \ContextMenuHandlers\igfxcui => key removed successfully
HKLM\Software\Classes\CLSID{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => key not found.
HKLM\Software\Classes\Directory\Background\ShellEx \ContextMenuHandlers\igfxDTCM => key removed successfully
HKLM\Software\Classes\CLSID{9B5F5829-A529-4B12-814A-E81BCB8D93FC} => key not found.
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => key removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => key removed successfully
HKU\S-1-5-21-2235556512-3620655794-2756196336-1001_Classes\CLSID{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => key removed successfully
C:\WINDOWS\system32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
========= netsh advfirewall reset =========
Ok.
========= End of CMD: =========
========= netsh advfirewall set allprofiles state On =========
Ok.
========= End of CMD: =========
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
=========== EmptyTemp: ==========
BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 86344007 B
Java, Flash, Steam htmlcache => 346023371 B
Windows/system/drivers => 18217506 B
Edge => 37261021 B
Chrome => 382816087 B
Firefox => 0 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 4830 B
NetworkService => 733004 B
Tom => 1247380473 B
RecycleBin => 0 B
EmptyTemp: => 2 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 16:42:29 ====
My C Drive:
Zemana AntiMalware 2.74.2.150 (Installed)
Scan Result : Completed
Scan Date : 2017/9/29
Operating System : Windows 10 64-bit
Processor : 4X Intel(R) Core™ i3-6100 CPU @ 3.70GHz
BIOS Mode : Legacy
CUID : 122A28AEB59F31361D0402
Scan Type : Custom Scan
Duration : 16m 56s
Scanned Objects : 441201
Detected Objects : 6
Excluded Objects : 0
Read Level : Normal
Auto Upload : Enabled
Detect All Extensions : Disabled
Scan Documents : Disabled
Domain Info : WORKGROUP,0,2
[HEADING=1]Detected Objects[/HEADING]
ld.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.exe
ld.bfd.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.bfd.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\avr\bin\ld.bfd.exe
avr-ld.bfd.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.bfd.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.bfd.exe
avr-ld.exe
Status : Scanned
Object : %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - %localappdata%\arduino15\packages\arduino\tools\av r-gcc\4.8.1-arduino5\bin\avr-ld.exe
INK.exe
Status : Scanned
Object : %programfiles%\steam\steamapps\common\ink\ink.exe
MD5 : 53D3FFB4D83C8DE75185527DC235D2F8
Publisher : -
Size : 14396928
Version : 1.0.0.1
Detection : Heur.Malicious!Pc
Cleaning Action : Quarantine
Related Objects :
File - %programfiles%\steam\steamapps\common\ink\ink.exe
winwb.exe
Status : Scanned
Object : %homedrive%\adwcleaner\quarantine\fraqbc8wsa\5.5.6 310.18878\winwb.exe
MD5 : ED2F7A31369BC899B32002A03BDDACFA
Publisher : Web Bar Media
Size : 197352
Version : 5.5.6310.18878
Detection : Adware:Win32/WebBar!Ep
Cleaning Action : Quarantine
Related Objects :
File - %homedrive%\adwcleaner\quarantine\fraqbc8wsa\5.5.6 310.18878\winwb.exe
[HEADING=1]Cleaning Result[/HEADING]
Cleaned : 6
Reported as safe : 0
Failed : 0
My D Drive:
Zemana AntiMalware 2.74.2.150 (Installed)
Scan Result : Completed
Scan Date : 2017/9/29
Operating System : Windows 10 64-bit
Processor : 4X Intel(R) Core™ i3-6100 CPU @ 3.70GHz
BIOS Mode : Legacy
CUID : 122A28AEB59F31361D0402
Scan Type : Custom Scan
Duration : 4m 52s
Scanned Objects : 27554
Detected Objects : 4
Excluded Objects : 0
Read Level : Normal
Auto Upload : Enabled
Detect All Extensions : Disabled
Scan Documents : Disabled
Domain Info : WORKGROUP,0,2
[HEADING=1]Detected Objects[/HEADING]
ld.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.exe
ld.bfd.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.bfd.ex e
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\avr\bin\ld.bfd.ex e
avr-ld.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.exe
avr-ld.bfd.exe
Status : Scanned
Object : D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.bfd.exe
MD5 : 89FABAA027C5FD2534CC5EDE076CDCD2
Publisher : -
Size : 1084416
Version : -
Detection : Malware:Win32/Vorniac.A!Tktk
Cleaning Action : Quarantine
Related Objects :
File - D:\Program Files (x86)\Arduino\hardware\tools\avr\bin\avr-ld.bfd.exe
[HEADING=1]Cleaning Result[/HEADING]
Cleaned : 4
Reported as safe : 0
Failed : 0
I dont use anything besides chrome so i dont know if the issue is there
ive done everything apart from the ads fix as it appears to have gone but if it is still here then i will do that and give you the report
If i have not seen anything to do with the adware in a couple of days then i will update you
Comment