Trojan JS/IframeREF Infection [Solved]

I found some threats that were either deleted or quarantined by the scanner. Foxx C:\Updater.exe probably a variant of Win32/Adware.Virtumonde.JMIMDOZ application cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eZulaHotText.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Instafin2.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ToolbarFacemood53.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\MovieBario_FM.exe probably a variant of Win32/SweetIM.A application cleaned by deleting - quarantined C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\SoftonicDownloader67854(2).exe a variant of Win32/SoftonicDownloader.A application cleaned by deleting - quarantined C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\SoftonicDownloader67854.exe a variant of Win32/SoftonicDownloader.A application cleaned by deleting - quarantined C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\rox.jar-13ac6530-67f33b7b.zip Java/Agent.V trojan deleted - quarantined C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\rox.jar-17b2de1c-3db1b3e1.zip Java/Agent.V trojan deleted - quarantined C:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll Win32/Adware.Yontoo.A application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At1.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At10.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At11.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At12.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At13.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At14.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At15.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At16.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At17.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At18.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At19.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At2.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At20.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At21.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At22.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At23.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At24.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At3.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At4.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At5.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At6.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At7.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At8.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At9.job.vir Win32/Adware.FakeAntiSpy.O.Gen application cleaned by deleting - quarantined C:\System Volume Information\_restore{8644B53C-E305-4C14-B2BD-C6673D25DC97}\RP1714\A0311385.exe Win32/Adware.Bundlore application deleted - quarantined C:\System Volume Information\_restore{8644B53C-E305-4C14-B2BD-C6673D25DC97}\RP1715\A0311579.exe probably a variant of Win32/Adware.Virtumonde.JMIMDOZ application cleaned by deleting - quarantined C:\System Volume Information\_restore{8644B53C-E305-4C14-B2BD-C6673D25DC97}\RP1715\A0311580.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined C:\System Volume Information\_restore{8644B53C-E305-4C14-B2BD-C6673D25DC97}\RP1715\A0311581.exe probably a variant of Win32/Agent.CQDIXFM trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{8644B53C-E305-4C14-B2BD-C6673D25DC97}\RP1715\A0311582.dll Win32/Adware.Yontoo.A application cleaned by deleting - quarantined C:\WINDOWS\Downloaded Installations\{635FBDCB-0ACB-4FD0-8F35-D30E3D863DDB}\Kazaa Gold Premium.msi probably a variant of Win32/Agent.COPKWSR trojan deleted - quarantined C:\WINDOWS\system32\asnmgbmp.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\cjjchnqy.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\crgphjjd.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\dkeraesd.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\emebxuih.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\flnrrvbf.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\gnccdfha.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\iddrctju.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\kbvrrceg.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\LnnoWvut.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\nsqepgir.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\nwvstlcs.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\ohlmmdfx.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\PqWHNXbc.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\qnqthnox.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\rnegbfgm.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\rYGQAcfe.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\svwektbs.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\tsxvlswj.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\wejyueqs.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\weoulmko.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\xrxagjuu.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPAJGTUF\rw[1].htm HTML/Iframe.B.Gen virus deleted - quarantined C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPAJGTUF\rw[2].htm HTML/Iframe.B.Gen virus deleted - quarantined

Good work DesertFoxx - as you say, that was stuff that had already been dealt with so it appears that your computer is clean.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix

• click START then RUN
• now type Combofix /uninstall in the runbox and click OK.

Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)

• please follow the prompts to uninstall Combofix.
• once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.

You can delete any other programs and files that we have used from off your desktop.

===================================================

Clear all your temporary files

Download ATF Cleaner

• double-click ATF-Cleaner.exe (on your desktop) to run the program.
• under Main choose: Select All
• click the Empty Selected button.

If you use Firefox browser

• click Firefox at the top and choose: Select All
• click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• click Opera at the top and choose: Select All
• click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu

===============================================

Firewall

You're using the Windows Firewall which is not adequate protection. The main reason you should use a third-party firewall over the Windows XP Firewall is because Windows Firewall only stops incoming signals from accessing your computer. However, it will not stop Outgoing signals (possibly ones that could intrude your privacy) from sending information to the Internet or to other networks. That means if malware happens to compromise your PC again, it will be able to SEND OUT out your credit card data and any other personal information.

I suggest you install a more robust third party firewall that filters both incoming and outgoing traffic.

Download and install one of the following freeware firewalls from below:

Sygate Personal Firewall Free Edition:
Zone Alarm Free:
Comodo Personal Firewall:

NOTE only install one firewall. Having more than one could cause many programs to stop working altogether. Also, the firewalls may get in each others' way and cause some security holes that would not be there with just one firewall.

When you have done that:

Disable Windows firewall:

• Click on Start, Settings and then Control Panel
• click on the Security Center icon.
• click on the Windows Firewall icon
• click Off (not recommended) and then click OK.

You should take the time to read Understanding and Using Firewalls

===================================================

Windows updates

I notice that Windows updates are waiting to be installed. Click here to get the latest Windows updates:

===================================================

Set your computer to automatically check for Windows updates.

To turn on Automatic Updates:

• click Start, Settings and then click Control Panel.
• double-click Automatic Updates.
• choose Automatic (recommended).

===================================================

Update installed programs

Your version of Flash Player is out-of-date and the Flash player included with SP3 is also old.

Go here and download the latest version.

NEXT

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 31 and save it to your desktop.
• Scroll down to where it says JDK 6 Update 31 (JDK or JRE)
• Click the Download JRE button to the right
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u31 with JavaFX 1 License Agreement". Click on Continue. The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u31-windows-i586.exe to install the newest version.

• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
    Trace and Log Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Window
• Click OK to leave the Java Control Panel.

===================================================

Recommended programs

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly. You can never update too often and your computer will not be protected from new malware if your programs are not up-to-date.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Please also remember what I told you about never running 2 antiviruses at the same time.

Safe computing

Satchfan

Hi Satchfan, Thank you very much for your help! Best regards from Canada, Foxx

You are welcome. Regatds from the UK Satchfan

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.