Java Agent AKG and Java Agent AKF [Solved]

Hi Gary,

I am glad to hear things are running better. As for whether the problems you are having with your games are due to the games' programming I can't say for sure. I have found some entries that needed to go but they weren't malware really. Let's check for anything that might still be hiding.

Malwarebytes

I see that you have Malwarebytes on your system. Please open Malwarebytes, update it and then run a Quick Scan. Please save the log that is created for your next reply.
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

• Do not use this instance of your browser for anything besides doing this scan
• When the scan is complete and the results saved, close that instance of your browser
• Open a new one the usual way and post the results in this topic.

• Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the Start button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option "Remove found threats" is Unchecked
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the Back button.
• Push Finish

http://www.eset.com/onlinescan/
———-

In your next reply please post the logs created by Malwarebytes and ESET online scanner.

Hello again Jeff:

Malwarebytes came back negative, but ESET had 4 positive results:

Here's Malwarebytes:


Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.20.02

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Gary :: GARY-PC [administrator]

1/20/2012 11:14:10 AM
mbam-log-2012-01-20 (11-14-10).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 569560
Time elapsed: 1 hour(s), 25 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Here is the ESET scan:

C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\7b2707d0-157cbf01 a variant of Java/TrojanDownloader.Agent.NDJ trojan
C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\d189d59-309fd357 a variant of Java/TrojanDownloader.Agent.NDJ trojan
C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\34584228-194c0ed0 Java/Agent.AC trojan
C:\Users\Gary\Desktop\dump\media.player.codec.pack.v4.0.2.setup.exe a variant of Win32/Toolbar.Widgi application


Gary.

Hi Gary,

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  

  File::
  C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\7b2707d0-157cbf01	
  C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\d189d59-309fd357	
  C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\34584228-194c0ed0	
  C:\Users\Gary\Desktop\dump\media.player.codec.pack.v4.0.2.setup.exe

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  [external image: Posted Image]
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

In your next reply please post the new ComboFix log and let me know if there are any remaining problems with your system.

No that was fine that you zipped it. How is your system running?

My system is running fine. I took the liberty of running another ESET scan and got positive results:


C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\7b2707d0-157cbf01 a variant of Java/TrojanDownloader.Agent.NDJ trojan deleted - quarantined
C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\d189d59-309fd357 a variant of Java/TrojanDownloader.Agent.NDJ trojan deleted - quarantined
C:\Users\Gary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\34584228-194c0ed0 Java/Agent.AC trojan deleted - quarantined
C:\Users\Gary\Desktop\dump\media.player.codec.pack.v4.0.2.setup.exe a variant of Win32/Toolbar.Widgi application deleted - quarantined

Hi,

Those have been quarantined already and they are not a problem.
———–

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
———-

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
———-

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

• NoScript
• AdBlockPlus

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

• Open Internet Explorer
• Click on Tools > Internet Options
• Press Security tab
• Select Internet zone then place check next to Enable Protected Mode if not already done
• Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
• Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Hello again:

I followed your recommendations. I normally use Chrome and I used their extensions "scriptno" and "adblock plus". ScriptNo is a version of Noscript and it made it impossible to view YouTube videos so I deactivated it. I still use adblock plus however on FF and Chrome. I haven't configured IE yet, but will get to that. My computer runs w/o issue, but I worry that I have keyloggers?

Instead of a software firewall, I hooked up my router and forwarded the necessary ports. Do I still need the firewall? I also took the liberty of downloading a free scanner from MS and got 7 positive results. I keep getting positive hits even though my logs look clear?


Exploit:Java/CVE - 2010-0840.DW
Exploit:Java/CVE - 2010-0840.DZ
Trojan:Java/Jasapryt
TrojanDownloader:Java/OpenConnection.OU

This is very odd behavior and I was wondering what you thought. Thanks.

Gary.

Hi Gary,

Everything that you are doing security-wise seems to be a good idea…from your extensions/add-ons to your choosing to use your router as a firewall. I would still use the Windows firewall though. That is what I do too.

As for the other entries, they all deal with Java so you may want to clear out your Java files or you can use this to clean them up. They are probably remnants sitting in Java cache.

Please download ATF Cleaner by Atribune to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.

[external image: Posted Image]

So everything is running well?

Hi,

I am happy that things are running well.

Running Windows Firewall at the moment. i was wondering if the online armor was better.

My thoughts on this…others may think differently…is that if you are using a computer behind a secured wireless router than the Windows firewall is sufficient; however, if you use your computer at other wifi hotspots than I would be sure to have a different firewall like Outpost or Online Armor. Hope that answers your questions.

Glad that I could help.