What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware/Spyware? [Solved]

93 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
That's looking fine.

One more scan should make sure that all is OK.

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Satchfan
Post #32
RE: ESETOnline Scan. Your instructions say to check "Scan Archives". I got to that point, but just above "Scan Archives", is a second choice, "Remove found threats" that is already check. Should I uncheck that and use just "Scan Archives" or should I scan with both "Remove found threats" AND "Scan Archives" checked?
Post #34
Here's the ESET Online Scan. It found 13 threats. Because I clicked "Remove found threats" along with "Scan Archives", were all these threats removed? ——————————————————————— C:\Documents and Settings\Jerry\Application Data\Sun\Java\Deployment\cache\6.0\46\7b1f6eae-39603cb7 multiple threats deleted - quarantined C:\Documents and Settings\Jerry\Application Data\Sun\Java\Deployment\cache\6.0\7\7d40e887-51748699 multiple threats deleted - quarantined C:\System Volume Information\_restore{8DE1C08A-B26A-4889-84BE-C64F35E7509F}\RP1755\A0138080.sys a variant of Win32/Rootkit.Kryptik.LP trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{8DE1C08A-B26A-4889-84BE-C64F35E7509F}\RP1756\A0138136.sys a variant of Win32/Rootkit.Kryptik.LP trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{8DE1C08A-B26A-4889-84BE-C64F35E7509F}\RP1758\A0140185.sys a variant of Win32/Rootkit.Kryptik.LP trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\rtkt0000\svc0000\tsk0000.dta a variant of Win32/Rootkit.Kryptik.LP trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\rtkt0000\zafs0000\tsk0002.dta Win32/Sirefef.DN trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\rtkt0000\zafs0000\tsk0008.dta Win32/Sirefef.ES trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\rtkt0000\zafs0000\tsk0010.dta a variant of Win32/Sirefef.EU trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\zaea0000\svc0000\tsk0000.dta Win32/Sirefef.ER trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\zaea0001\svc0000\tsk0000.dta Win32/Sirefef.ER trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\zaea0002\svc0000\tsk0000.dta Win32/Sirefef.ER trojan cleaned by deleting - quarantined C:\TDSSKiller_Quarantine\12.05.2012_11.35.57\zaea0003\svc0000\tsk0000.dta Win32/Sirefef.ER trojan cleaned by deleting - quarantined
Post #35
That is all OK.

You’ve done a good job jwr243

The Eset scan is only reporting files located in System Restore's cache or others that have been quarantined. Whatever is in these folders can't harm your computer unless you choose to perform a manual restore. The following steps will remove these files.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

You can delete the DDS, TDSSKiller, SecurityCheck and aswMBR logs and programs from your desktop.

Uninstall Combofix

Follow these steps to uninstall Combofix
  • click START then RUN
  • now type Combofix /uninstall in the runbox and click OK.
Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)
  • please follow the prompts to uninstall Combofix.
  • once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================

Uninstall and update Java

The version you have is old and therefore vulnerable to infections.

Remove all versions of Java or JRE environment
  • click on Start, Settings, Control Panel.
  • double-click Add Remove Programs.
  • look for all versions of Java or Java Rintime Environment, and click Uninstall. Alternatively, right-click the program and select Uninstall.
Install the latest version from here

===================================================

Firewall

You're using the Windows Firewall which is not adequate protection. The main reason you should use a third-party firewall over the Windows XP Firewall is because Windows Firewall only stops incoming signals from accessing your computer. However, it will not stop Outgoing signals (possibly ones that could intrude your privacy) from sending information to the Internet or to other networks. That means if malware happens to compromise your PC again, it will be able to SEND OUT out your credit card data and any other personal information.

I suggest you install a more robust third party firewall that filters both incoming and outgoing traffic.

Download and install one of the following freeware firewalls from below:

Sygate Personal Firewall Free Edition:
Zone Alarm Free:
Comodo Personal Firewall:

NOTE only install one firewall. Having more than one could cause many programs to stop working altogether. Also, the firewalls may get in each others' way and cause some security holes that would not be there with just one firewall.

When you have done that:

Disable Windows firewall:
  • Click on Start, Settings and then Control Panel
  • Click on the Security Center icon.
  • Click on the Windows Firewall icon
  • Click Off (not recommended) and then click OK.
You should take the time to read Understanding and Using Firewalls

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan
Post #36
Should I also delete ESET Online Scanner, Hijack This, and ATF Cleaner from the desktop? ESET Online Scanner and Hijack This are both in the Add/Remove section of the Control Panel. If they should be deleted from the desktop, should I uninstall them using Add/Remove? Is it ok to delete the various log files now?
Post #37
A question about uninstalling JAVA. In the Add/Remove box of the Control Panel, there are two JAVA items: Java™ 6 Update 20, and Java™ SE Runtime Environment 6. Sould remove both?
Post #38
My apologies, I should have included the fact that you can uninstall HijackThis and Eset from Add or remove programs.

Is it ok to delete the various log files now?

Yes.

A question about uninstalling JAVA. In the Add/Remove box of the Control Panel, there are two JAVA items: Java™ 6 Update 20, and Java™ SE Runtime Environment 6. Sould remove both?

Yes. As I mentioned in the "Java" section in my advice post, (Post 35), both are old versions which can leave your computer open to infection.

Satchfan
Post #39
Your link to the Java installation page brought some more questions. There is a link there to verify which Java is now installed. It is version 6, update 20. On that same verification page is a button to click to update to version 7. Can I use that to update without uninstalling? When I began to uninstall using Add/Remove, it started, then stopped, and a box came up saying, "Your browser is currently using Java and must be closed so that Java files can be updated. Windows Internet Explorer. Save your work, then click "Close browser" and continue". I was trying to remove Java, so why would it update anything?. If the browser (IE) is using Java and I uninstall Java, will that interfere with Internet Explorer? I wasn't sure what to do, so I clicked Cancel. The Java set-up box came up, saying, "The Java update is incomplete. Click OK to complete it next time you login". Again, I wasn't sure what to do, so clicked the X in the upper right of the box..
Post #40 last edited
There is a program that will help you do it all more easily.

Please download JavaRa to your desktop and unzip it to its own folder
  • double-click on JavaRa.exe to start the program
  • from the drop-down menu, choose English or the appropriate language…and click on Select.
  • click Remove Older Versions to remove the older versions of Java installed on your computer
  • accept any prompts.
  • open JavaRa.exe again and select Search For Updates.
  • select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
Let me know how it goes.

Satchfan
Post #41
I tried to download JavaRa several times using the link provided, but each time a box comes up saying, "Inteternet Explorer cannot display the webpage. What you can try: Diagnose Connection Problem" This Diagnose Connection Problem section states it is for boradband modem (cable or DSL). I am using a dial-up connection, but tried the Diagnose Connection Problem anyway. After a few seconds a messsage came back saying no connection problem was found. I/m not sure if this means anything because it does say it's for a boradband connection. I clicked More Information and it says the sight may not be available, the domain name may have changed, etc. Any ideas?
Post #44
That worked and I have it saved to the desktop,.When I click the folder, it brings up a box with 9 various files. Seven are languages. One is a Notebook file labled JavaRa which is a long list of HKEY, etc. type files. Another JavaRa file, when clicked, brings up a box that says, "Compressed (zipped) Folders…. This application may depend on other compressed files in this folder. For the application to run properly, it is recommended that you first extract all files." Below this are three buttons, "Extract All", "Run", Cancel". If this is where I'm suppose to be at this point, I presume I should cl ick "Extract All", but what do I do with the files once they are extracted?
Post #45
The RUNdll error box that came up when I booted, was sonmething like DXSurface file could not be found. That is gone now, but in My Computer > local disk(C:) > Common Files, is a folder labled DXSurface. It is empty. Can I delete that, or is that something I may need? Also, I used Add/Remove to unisntall HijackThis. It is gone from Add/Remove, and I deleted the desktop icon, but the program still appears in My Computer > local disk (C:) >Program Files, under a folder labled Trend Micro. Is it ok to delete this? One last question. I deleted ComboFix, but a folder for it still appears in My Computer > Local disk(C:). Is it ok to delete that?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI