[Resolved] Exploit.Java.Agent.f and paretologic (continued I)

ok, here is the result. the system and mozilla seem to run normal. only the system seems to work hard, because the fan keeps running all the time. All processes killed ========== FILES ========== C:\Dokumente und Einstellungen\Ulrike Klöppel\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\45\352e636d-4eab7c81 moved successfully. C:\Dokumente und Einstellungen\Ulrike Klöppel\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\54\11c850f6-6e601624 moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Besitzer User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 2860 bytes User: Ulrike Klppel ->Temp folder emptied: 2819 bytes User: Ulrike Klöppel ->Temp folder emptied: 107803612 bytes ->Temporary Internet Files folder emptied: 267028 bytes ->Java cache emptied: 73018823 bytes ->FireFox cache emptied: 85026533 bytes ->Flash cache emptied: 43242 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 39097 bytes %systemroot%\System32 .tmp files removed: 1163143 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 425 bytes RecycleBin emptied: 66085195 bytes Total Files Cleaned = 318,00 mb OTM by OldTimer - Version 3.1.12.0 log created on 05202010_163525 Files moved on Reboot… File C:\Dokumente und Einstellungen\Ulrike Klöppel\Lokale Einstellungen\Temp\JETC563.tmp not found! Registry entries deleted on Reboot…

ulli,

Your logs look clean. If you want to make an inquiry about your system running "hard" feel free to open a new topic in our Microsoft Windows Forum. Be sure to give the helper there a link back to this thread.

Before you do that though, I have some important cleanup and housekeeping for you to take care of:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
• Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 20. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
• Click the "Download" button to the right.
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.
• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    Applications and AppletsTrace and Log Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Window
• Click OK to leave the Java Control Panel.

🖼Click to load external image (Posted Image) Uninstall ComboFix

• Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
  Combofix /Uninstall

🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Cleanup with OTM

• Double-click OTM.exe to start the program.
• Close all other programs apart from OTM as this step will require a reboot
• On the OTM main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.
• Manually delete any remaining tools or logs from our work

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

• Restart any anti-malware programs that we disabled while we were cleaning your machine.
• Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
• Consider running in a limited user account. See this post for more information.
• Please carefully review the information in our Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

I followed your instructions. Thank you very much for your excellent help!

You're welcome. Thanks for your patience.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.