[Resolved] trojan exploit-swf

My mcafee online virus scan picks this up but then does not remove it?, so can i remove this please

Hi and Welcome,

NOTE:

• Malware removal is NOT instantaneous.
• Most infections require more than one round to properly eradicate.
• Absence of symptoms does not always mean the job is complete.
• You can be certain that I will advise you when the computer is clean.
• Kindly follow my instructions in the order posted.
• Please resist the urge to run further scans or fix items on your own without my direction.

Please do the following:

STEP #1

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



STEP #2


Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.


Please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

tks, have done all that was suggested and have attached the files, my computer very slow and just logging on google takes time. i have been on internet banking, concerned/ should i take any action ; as in change passwords etc?

Hi,

Please do the following:

Please download JavaRa to your desktop and unzip it to its own folder.

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
• Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 14)

Next

Download TFC to your desktop

• Close any open windows.
• Double click the TFC icon to run the program
• TFC will close all open programs itself in order to run,
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish it's job
• Once its finished it should automatically reboot your machine,
• if it doesn't, manually reboot to ensure a complete clean

NEXT

Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
  
  [external image: Posted Image]
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

In your next reply please include

• MBAM Log
• Kaspersky report

Hi, sorry i took so long to get back but i have been in bed for 2 days! I have encountered a problem. I downloaded the updated java version6, update 14 and ran the TFC program, rebooted as req, and also ran the malwarebytes anti malware program, the results i have copied onto a word document attached. However when i try and run Kaspersky it gives me the error message: "you need to install Java Version 1.6 or later to run Kaspersky online Scanner7.0", so i entered the site and tried the :test your version" and got an error message which I have also attached in the word document. could you plse assist me? many many many tks, molly

NOTE: Make sure the Java Addon in IE is enabled.

Go to Tools > Internet Options > Advanced tab. Click Reset then OK and exit IE

Re-open IE and ensure the Java add-ons are enabled.

[external image: Posted Image]

Hi, im really being tested on my pc knowledge here which is scanty to say the least! I still have a problem, i uninstalled all java and re=installed, but still Kapsersky cant find java on my computer, so i checked again and it appears that java not loaded as an add on to internet but as an add on that shows as downloaded on activeX controls (32 bit) ????? my download destination mya be incorrect but how do i change it? also attaching another word doc, with my attemts to download java before i unitalled. ?? molly p.s surprised this service is for free? in the UK mcafee would do this for me, ie take control of my computer and fix it, and i would pay for the service, but they do not offer this service in SA, can it be done in SA?? as in with you guys?

Hi,

i'm sorry, I'm not sure what the issue is with the Java that you are describing.

Did you choose to download version 6 update 14 from the java site?

Try again from here:

http://www.java.com/en/download/manual.jsp

download and install manually, then return to that location to verify the installation.

In the meantime do this scan instead.

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the [external image: Posted Image] button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the [external image: Posted Image] button.
• Push [external image: Posted Image]

and to answer your other question - we only offer assistance through the forums

hi scan just completed and NO THREATS found, but when i look under manage add-ons, you still cant see the java, so i cant get to Kaspersky??? under the "manage add ons" you get 3 options: 1. add ons currently loaded in IE - no java files 2. add ons that run without req permission - yes all java shown there 3. downloaded Active X controls (32 bit) - yes all java shown there is that correct or should they show under the 1st option IE??? only asking as Kaspersky cant pick up the java files downloaded and keeps on asking me to install java version 1.6 etc and yes, ive definatley downloaded version 6 , update 14 what now? molly

Hi, Please post a fresh DDS log

morning, files attached as req. maybe the virus is gone should i run a macafee virus scan again? molly

Hi,

Your log is clean,

time to do some housekeeping:

For the Java issues, please do this:

Open I.E. Go to Tools > Internet Options > click on the "Advanced Tab"

Scroll down about halfway till you see "Java"

Make sure the box is checked beside Use JRE 1.6.0_14 for

Hit the apply button, then OK > reboot your computer.


NEXT


Now to remove the rest of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

NEXT

Now we need to create a new clean SYSTEM RESTORE point.

• Close and save any documents that you may have open.
• Open up the Start Menu and right-click on "Computer", and then select "Properties"
• This will take you into the System area of Control Panel. Click on the "Advanced system settings" on the left hand side.
• Now select the "System Protection" tab to get to the System Restore section.
• Click the "Create" button to create a new restore point. You'll be prompted for a name, and you might want to give it a useful name that you'll be able to easily identify later.
• Click the Create button, and then the system will create the restore point.
• When it's all finished, you'll get a message saying it's completed successfully.
• You will now have a new restore point

Then remove all previous Restore Points

• Click Start Menu > Run > copy and paste
• cleanmgr into the run box
• At the top, click on the More Options tab, under System Restore and Shadow Copies group,
• Click the Clean up button,
• Vista will ask you if you’re sure, click on Yes button.
• When finished, click on Cancel button to exit.
  
  
  
  
  NEXT
  
  Below I have included a number of recommendations for how to protect your computer against malware infections.
  
  
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  • Make Internet Explorer more secure
    
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
    
    
  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
    
    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE
    
    
  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
    Here
    
    
    If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
    
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
    
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
    
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.
  
  
  **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.
  
  
  Thank you for your patience, and performing all of the procedures requested.
  
  Please respond one last time so we can consider the thread resolved and close it, thank-you.

thank you, will do and reply in the morning. molly

Hi, when i open IE and go to advanced tabs a scroll down i see NO "java" honestly! wish i could copy that screen for you to see, but its not there. under manage addons it only shows under the addons that "run without req permission" but NOT under "addons curently loaded in internet explorer"?? will continue to do the rest and wait to see wht we can do with java. tks, molly

Hi, can you please advise re the step to remove restore points: i click start and get the run menu, i have no More Options tab??? all i have is a one line box into which you can type cleanmgr, at the bottom i have 3 boxes giving me the iption of OK, CANCEL and BROWSE if you go into browse you can now get into your files, but i dont know what to look for i tried system restore and shadow copies etc but no go, are your instructions based on a vista screen?? plse can you help ..again. molly