[Resolved] Possible Viruses...

Hi,

Are you able to navigate to the infected files found by ESET in the C:\My Backup folder to delete them?

Don't worry anbout the other ones, they are in quarantine and will be cleared on the final clean up.

Pleas run the following command


Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

A text file should open.

Post the contents of that file in your next reply.

How do I go about deleting them? Here is the log: Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 7.0 Adobe Shockwave Player 11.5 Agilix GoBinder Lite America Online (Choose which version to remove) Browser Address Error Redirector Crawler Toolbar with Web Security Guard Cucusoft DVD to iPod + iPod Video Converter Suite [removed] DVD Solution ERUNT 1.1j getPlus® for Adobe Google Desktop Google Toolbar for Internet Explorer gtw_logo High Definition Audio Driver Package - KB888111 Hotfix for Microsoft .NET Framework 2.0 (KB922981) Hotfix for Microsoft .NET Framework 2.0 (KB923319) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB952287) Ink Art Intel Matrix Storage Manager Intel® Graphics Media Accelerator Driver Intel® PRO Network Connections Drivers Intel® PROSet/Wireless Software J2SE Runtime Environment 5.0 Update 2 Java™ 6 Update 7 Malwarebytes' Anti-Malware mCore mDriver mDrWiFi mHelp Microsoft .NET Framework 1.0 Hotfix (KB930494) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft Digital Image Library 9 - Blocker Microsoft Digital Image Starter Edition 2006 Microsoft Digital Image Starter Edition 2006 Editor Microsoft Digital Image Starter Edition 2006 Library Microsoft Education Pack for Windows XP Tablet PC Edition Microsoft Energy Blue Theme Pack Microsoft Experience Pack for Tablet PC Microsoft Ink Crossword Microsoft Ink Desktop Microsoft Internationalized Domain Names Mitigation APIs Microsoft Media Transfer Microsoft Money 2006 Microsoft National Language Support Downlevel APIs Microsoft Office OneNote 2003 Microsoft Office Standard Edition 2003 Microsoft Snipping Tool 2.0 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works mIWA mLogView mMHouse Motorola SM56 Data Fax Modem Move Networks Media Player for Internet Explorer Mozilla Firefox (3.0.13) mPfMgr mPfWiz mProSafe MSXML 4.0 SP2 (KB954430) mWlsSafe mXML mZConfig Napster Napster Burn Engine OpenOffice.org 3.0 PL-2303 USB-to-Serial Power2Go 4.0 PowerDVD Pure Networks Port Magic QuickTime RealPlayer Basic Recovery Software Suite Gateway Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB973346) SigmaTel Audio Spyware Terminator Synaptics Pointing Device Driver Tablet PC Tutorials for Microsoft Windows XP SP2 TBS WMP Plug-in Texas Instruments PCIxx21/x515/xx12 drivers. TIPCI Update for Windows XP (KB898461) Update for Windows XP (KB904942) Update for Windows XP (KB932823-v3) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Viewpoint Media Player WebFldrs XP Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Media Format Runtime Windows Media Player 10 Yahoo! Toolbar

Hi,

We'll use OTM to delete those files for you:

Please do the following:

Please download OTM by OldTimer.

• Save it to your desktop.
• Please click OTM and then click >> run.
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\My Backup – 08-11-30 0946PM\Program Files\Mozilla Firefox\chrome\amba.jar 
C:\My Backup – 08-11-30 0946PM\Program Files\SelectRebates\SelectRebates.exe 
C:\My Backup – 08-11-30 0946PM\Program Files\SelectRebates\SelectRebatesApi.exe 
C:\My Backup – 08-11-30 0946PM\Program Files\SelectRebates\SelectRebatesUninstall.exe 
C:\My Backup – 08-11-30 0946PM\WINDOWS\system32\aaGjmnmp.ini 
C:\My Backup – 08-11-30 0946PM\WINDOWS\system32\aaGjmnmp.ini2 
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GK2SVGE9\static[1].exe 

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



NEXT:

Visit ADOBEand download the latest version of Acrobat Reader (version 9.1.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT


Please download JavaRa to your desktop and unzip it to its own folder.

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
• Scroll down to the Java SE Runtime Environment (JRE) option.
• Download and install the latest Java Runtime Environment (JRE) version for your computer.(version 6, update 15)

All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== FILES ========== C:\My Backup – 08-11-30 0946PM\Program Files\Mozilla Firefox\chrome\amba.jar moved successfully. C:\My Backup – 08-11-30 0946PM\Program Files\SelectRebates\SelectRebates.exe moved successfully. C:\My Backup – 08-11-30 0946PM\Program Files\SelectRebates\SelectRebatesApi.exe moved successfully. C:\My Backup – 08-11-30 0946PM\Program Files\SelectRebates\SelectRebatesUninstall.exe moved successfully. C:\My Backup – 08-11-30 0946PM\WINDOWS\system32\aaGjmnmp.ini moved successfully. C:\My Backup – 08-11-30 0946PM\WINDOWS\system32\aaGjmnmp.ini2 moved successfully. C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GK2SVGE9\static[1].exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 65536 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Owner ->Temp folder emptied: 77263311 bytes ->Temporary Internet Files folder emptied: 27414315 bytes ->Java cache emptied: 135918 bytes ->FireFox cache emptied: 38215164 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 0 bytes File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_668.dat scheduled to be deleted on reboot. Windows Temp folder emptied: 52693 bytes RecycleBin emptied: 34061 bytes Total Files Cleaned = 136.60 mb OTM by OldTimer - Version 3.0.0.6 log created on 08112009_135930 Files moved on Reboot… C:\WINDOWS\temp\Perflib_Perfdata_668.dat moved successfully. Registry entries deleted on Reboot…

Hi,

You appear to be clean,

just some house cleaning to do now,

please do the following:

Follow these steps to uninstall Combofix

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them
  Then consider a password keeper, to keep all your passwords safe.
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
  
• For Firefox, I highly recommend this add-on to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  Think Prevention.
  PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Thank you both. I have done everything recommended!

You are more than welcome stay safe ~CB

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.