Help with removal of Adware.ChinAd and Adware.Agent.E

Toggle sidebar Toggle sidebar
Status
Not open for further replies.
L

lospider

Honorable
Nov 28, 2013
6
0
10,510
Hello, guys!

A few days ago my PC was infected by several malwares (got them from a file I downloaded). I cleaned most of them, but these two remained: Adware.ChinAd and Adware.Agent.E. Both are detected by Malwarebytes which can't remove them (asks for reboot to complete the disinfection, but detects the adwares again).
I tried the following sequence: Safe mode -> Rkill -> Malwarebyes -> HitmanPro -> JRT -> Zemana -> ADWCleaner, but it doesn't work.
Can anyone help me get rid of these "bugs"?

Thanks!
 
Solution
M
Sort by date Sort by votes
JoshRoss

JoshRoss

Notable
Jul 11, 2017
232
0
860
Addition to your tried options I suggest you try Spyhunter, it seems to deal with these niche malware quite effectively. Did you do a thorough scan with your anti-virus software? Did you look at your installed programs for any malicious ones?

It is interesting, how your course of action didn't solve the issue, It seemed to have helped everyone else with this issue. You could also try CCleaner to clean up your registries. Let me know if it helps.
 
Upvote 0 Downvote
M

mdd1963

Titan
Jan 14, 2006
16,616
1,735
81,240
If malwarebytes identifies exactly where they are located, you might be able to use Sysinternals' Process Explorer to suspend each process, (and identify if this process is spawned/rehatched by another process) . and then delete it/them. (Run Process Explorer as Admin)
 
Upvote 0 Downvote
L

lospider

Honorable
Nov 28, 2013
6
0
10,510


I tried SpyHunter and it deleted 11 register entries (none of them related to those 2).
The antivirus didn't detect anything.
There aren't any malicious software listed on Control Pannel.
I also tried CCleaner and it didn't help either, unfortunatelly.
Thanks for the help!



I can't find the processes via Process Explorer. They are located on "C:\WINDOWS\SYSTEM32\drivers\'random name.sys'" and on "C:\WINDOWS\SYSTEM32\R6LSTMP4.DAT", but when I delete them they keep respawning.

Is there anything I can try?
 
Upvote 0 Downvote
JoshRoss

JoshRoss

Notable
Jul 11, 2017
232
0
860


What about services that are currently running on your PC? You could use either Task Manager, or more advanced version of that Process Explorer and enable virus total scan in Process Explorer, maybe you can identify the services, find the registries they have made and remove them. It is a long shot though.

Alternatively, you could back-up all of you important data to a free cloud service and do a clean reinstall of your PC, but that is a very inconvenient method.
 
Upvote 0 Downvote
M

mdd1963

Titan
Jan 14, 2006
16,616
1,735
81,240


Process Explorer's lower pane shows vital data is to where this process originated from, and, hopefully will allow you to see where the tasks are spawning from,,,,; if you can track them, suspend both tasks, then delete both...

If you have some codependent Lazarus processes that keep respawning each other, it will be difficult. At some point, if you can't track them down, delete partitions. and a full reinstall will for sure 'nuke 'em'....

If you can see tasks the assorted mystery tasks in Process Explorer (run it as admin, by the way), suspend all tasks which look suspect; then delete them
 
Upvote 0 Downvote
Solution
Status
Not open for further replies.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom