This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

5 trojans, other viruses, antivirus disabled, other programs

58 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

No, the computer isn't working ok. My AOL account or software is now notgood up. Java doesn't seem to be working. I can't get my saved searches on eBay to work because I can't click anything. It just sits there. Firefox is possibly working ok but I can't/won't go back to my own messageboard for fear of getting even more of this stuff. :( Which log looks ok? Malwarebytes? Surely not the Kaspersky log. What about the OTL log? Was I supposed to run that as administrator with all other programs closed because I didn't do that. I just ran it while I was waiting to post the Kaspersky log. Sorry.

Which log looks ok? Malwarebytes? Surely not the Kaspersky log. What about the OTL log? Was I supposed to run that as administrator with all other programs closed because I didn't do that. I just ran it while I was waiting to post the Kaspersky log. Sorry.

Hi,

I was talking about OTL log reported clean. - Yeah, you are supposed to run all tools as administrator with all other programs closed, and if possible try to stick with running one program at a time so that we can obtain more accurate results. :)

Meanwhile,

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Files
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\6570075d-2a14713a
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa
    E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa
    C:\Users\Ratopia\AppData\Local\eguijtecq
    C:\Users\Ratopia\AppData\Local\xbdftonow
    
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
===================================================

Go to this link : https://cds.sun.com/is-bin/INTERSHOP.enfini…S-CDS_Developer

And download Sun Java 6U20

Then,

Please uninstall the following Programs using the Programs and Features utility if they exist.
Java™ 6 Update 18
J2SE Runtime Environment 5.0 Update 3


Once done, reinstall your Java 6U20 by right clicking it and run as administrator, then follow the instructions.

===================================================

On your next reply please post :
OTL log
Can you get Java to work now?

Good Day!
All processes killed ========== FILES ========== File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb not found. File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb not found. File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb not found. File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\6570075d-2a14713a not found. File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa not found. File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa not found. File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa not found. C:\Users\Ratopia\AppData\Local\eguijtecq folder moved successfully. C:\Users\Ratopia\AppData\Local\xbdftonow folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Ratopia ->Temp folder emptied: 108896992 bytes ->Temporary Internet Files folder emptied: 83836355 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 79320877 bytes ->Flash cache emptied: 16205 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 100152 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 564927 bytes Total Files Cleaned = 260.00 mb OTL by OldTimer - Version 3.2.5.2 log created on 06032010_171026 Files\Folders moved on Reboot… C:\Users\Ratopia\AppData\Local\Temp\RtkBtMnt.exe moved successfully. Registry entries deleted on Reboot…
Which platform am I supposed to use to download that java? x64 Windows? There are quite a few choices and I don't see anything I recognize. Java is not working well at all. Firefox keeps crashing.
The only message I recall getting is that a window pops up and says Firefox has crashed and do I want to wait or close it, I think…
My apologies, I forgot to mention to you for the OTL fix, you have to plug in your external HDD. If you haven't done so yet, then please repeat the process given earlier in my last post. When you are finished, plug it off immediately and post the OTL log. Are you able to do a reinstall for Java and get it working? If not, I would like to suggest a reinstall for Firefox. Get it uninstalled, reboot, then install it.
Firefox just crashed again. This is the message. We're sorry, Firefox had a problem and crashed. We'll try to restore your tabe and windows when it restarts. To help us diagnose and fix the problem, yhou can send us a crash report. (tick box) Tell Moxilla about this crash so they can fix it. Box to type message or comments in. Anohter ticker box to send a report including the page/s I was on. buttons to either restart or quit Firefox ———————————— Now I'm going to install the Java and uninstall what you said to uninstall, then run the OTL log and post it, again.
Well. I ran OTL as instructed and OTL said the computer had to be rebooted to finish. I forgot to save the log to the desktop and now I can't find it. :pullhair: I did all the Java fixes as directed and things seem to be running so much better than yesterday and last week, etc. One other thing - I keep getting this windows message on almost every website I am on and it repeats, over and over and is very annoying. Is there something we can do about this? It must be in my privacy settings. This mostly happens with MSIE, not Firefox. Thanks! ——————————————————– Windows Internet Explorer One or more ActiveX controls could not be displayed because either: 1 Your current security settings prohibit running ActieX controls on this page, or 2 You have blocked a publisher of one of the controls. As a result, the page may not display correctly.
You should be able to find the log under C:\_OTL\MovedFiles\ mm/dd/year_hh/mm/sec.log

So Firefox is running well back again right?

As for your ActiveX.. refer below

Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Internet Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
All the ActiveX settings were the same as you suggested I change them to except for this one.

Change the Navigate sub-frames across different domains to Prompt.

I changed that, then found the log. Firefox was acting up bad last night. Pages were only loading half way and I couldn't click on any buttons on websites, such as eBay, nor maximize photos when clicking them.

Here's the log.

All processes killed
========== FILES ==========
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb not found.
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb not found.
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\720b4111-5e1337fb not found.
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\6570075d-2a14713a not found.
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa not found.
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa not found.
File\Folder E:\Seagate Backup\RATOPIA-PC\C\Users\Ratopia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\784fe349-595c08aa not found.
File\Folder C:\Users\Ratopia\AppData\Local\eguijtecq not found.
File\Folder C:\Users\Ratopia\AppData\Local\xbdftonow not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Ratopia
->Temp folder emptied: 663812 bytes
->Temporary Internet Files folder emptied: 84004021 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 87285369 bytes
->Flash cache emptied: 12819 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 33384 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 70866 bytes

Total Files Cleaned = 164.00 mb


OTL by OldTimer - Version 3.2.5.2 log created on 06042010_012237

Files\Folders moved on Reboot…
C:\Users\Ratopia\AppData\Local\Temp\RtkBtMnt.exe moved successfully.

Registry entries deleted on Reboot…
Are you still receiving windows message n IE after the remedy? Please disable all the add-ons you have on Firefox and restart your browser. Tools -> Add-ons -> Extensions tab highlight any add-ons you see -> click disable Tell me if the problem still persists.

Are you still receiving windows message n IE after the remedy?

Please disable all the add-ons you have on Firefox and restart your browser.
Tools -> Add-ons -> Extensions tab highlight any add-ons you see -> click disable

Tell me if the problem still persists.


OK, but just remember, in case you didn't know, my main browser is with AOL and that's where I am getting those error messages. And, yea, I am still getting them. I use AOL, MSIE and Firefox, sometimes at the same time. I guess I really push this computer but I need to. LOL

So what add-ons should I actually disable, then?
Hi,

CoolCat, Your computer appears to be free of any Malware. Since this is only browser related issue, we have a forum specifically cater to this and I need you to go here and open up a thread, post the link : http://forums.whatthetech.com/5_trojans_ot…ed_t112143.html and tell them that you have been previously helped by me and were given all clear, then describe as detailed as possible about your problem that you are facing.

I will also continue to look out on the thread you create :)

With that said, here is my all clean speech

Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
===================================================

Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

1. Create a new Restore Point
  • Click on the Start Orb button to open your Start Menu.
  • Click on the Control Panel menu option.
  • Click on the System and Maintenance menu option.
  • Click on the System menu option.
  • Click on System Protection in the left-hand task list.
  • Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
  • Type in a title for the manual restore point and press the Create button.
  • Close the System window after you have been advised that the procedure has been successfully completed.
.
2. Clear your existing system restore points except for the new clean restore point you just created:
  • Go to Start Orb and type in cleanmgr in the Start Search box.
  • Select the More options tab
  • Next to System Restore click Clean up
  • This will remove all restore points except the new one you just created.
Here are some tips to reduce the potential for spyware infection in the future:


1. Use and Update an Anti-Virus Software - I can not overemphasize the need for you to use and update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

2. FIREWALL
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

Do not install more than one firewall program because they will conflict with each other

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI