Friend's pc infected with lyricssing.js spyware

Lenovo G460 laptop computer - 06779xu...
March 31, 2014 at 20:24:34
Specs: Win 7 Home Premium SP1 64 bit, 2.16/3G
Friend's computer infected with lyricssing.js spyware. I'm assuming that's a Javascript association. I tried all online solutions that I could find. Also scanned with Avast anitvirus, MalwareBytes Anti-Malware , NoAdware, and SuperAntiSpyware. Items were found and removed, but not the one I was hoping for. Any input would be appreciated! Thanks,

vandal67


See More: Friends pc infected with lyricssing.js spyware

Report •


#1
March 31, 2014 at 21:13:09
Try rescanning in Safe Mode.
Failing that, try a system restore to a date well before the infection (rolls back registry), restart directly into safe mode after the restore and run Malwarebytes (and possibly others if needed) again there.
Other suggestions will probably follow.

You have to be a little bit crazy to keep you from going insane.


Report •

#2
March 31, 2014 at 21:15:22
Thanks, I'll give it a try.

vandal67


Report •

#3
April 1, 2014 at 01:33:04
This will take 5 or 6 steps, here are the first 2 steps.

Run in this order.

1: Run AdwCleaner
http://www.softpedia.com/get/Antivi...
http://www.softpedia.com/progScreen...
How to download from Softpedia
http://i.imgur.com/BWELEfV.gif
http://i.imgur.com/4luY3rU.gif
http://www.raymond.cc/blog/adwclean...
http://www.bleepingcomputer.com/dow...
Author's site
http://general-changelog-team.fr/en...
Tutorial
http://general-changelog-team.fr/en...
Please download AdwCleaner by Xplode onto your Desktop.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Clean.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please Copy & Paste the contents of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

2: Run Junkware Removal Tool
http://www.softpedia.com/get/Securi...
http://www.softpedia.com/progScreen...
How to download from Softpedia
http://i.imgur.com/qO92huz.gif
http://i.imgur.com/qzTUYkX.gif
http://www.bleepingcomputer.com/dow...
http://thisisudax.blogspot.com.au/2...
Download Junkware Removal Tool to your Desktop.
Warning! Once the scan is complete JRT will shut down your browser with NO warning.
Shut down your protection software now to avoid potential conflicts.
Temporarily disable your antivirus and any antispyware real time protection before performing a scan.
Click this link to see a list of security programs that should be disabled and how to disable them.
http://www.bleepingcomputer.com/for...
http://www.techsupportforum.com/for...
Run the tool by double-clicking it. If you are using Windows Vista or Windows 7/8, right-click JRT and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Copy and Paste the contents of the JRT.txt log please.


Report •

Related Solutions

#4
April 1, 2014 at 16:18:36
Ran system restore from 3 starting points, but didn't work. Received error0X80070005

vandal67


Report •

#5
April 1, 2014 at 16:34:29
If Norton is installed, turn off Tamper Protection.

http://www.filedropper.com/norton


Report •

#6
April 1, 2014 at 16:43:39
I don't have Norton installed.

vandal67


Report •

#7
April 1, 2014 at 16:45:38
Ok, I shall wait for the scan results as per my post #3

Report •

#8
April 1, 2014 at 20:26:22
I ran Malwarebytes and SuperAntiSpyware in safe mode, and that seems to have removed lyricssing.js. I then discovered RVZR-a.akamaihd.net. I searched for solutions and removed it. So, everything appears to be ok for now. Thanks to Fingers and johnw for suggestions.

vandal67


Report •

#9
April 2, 2014 at 00:03:02
"So, everything appears to be ok"
Doubt it, you will still have stuff lurking.

Report •

#10
April 2, 2014 at 20:10:25
Thanks, John. When I get time, I'll run your first 2 suggestions and report back.

vandal67


Report •

Ask Question