for Jeff - Need your expertise again! [Solved]

Good Morning from frosty Pittsburgh! I do have the install disk for Word & Excel 2010 - I bought them just in case!!! I uninstalled all Java - they trick you by calling the uninstall - UPDATE….geez! I ran malawarebytes and will attach the log. I don't have time to do the ESET scanner - may try that one tonight to keep in the loop here. I look forward to continuing! We are to get 1-3 inches of snow today….great…..want some? dar

Hi, Good to hear that you have the disks for Word and Excel. We may need them. When you get the log for ESET be sure to post that so we can get a look. As for the snow….send it my way! I haven't seen a real snow in years since I lived in Boston!

Jeff

Give me your address….I will Fedex all my snow!!! Since we are going to Cleveland saturday, I'm sure they will have more snow there! Will pass your address along so you can have MORE SNOW!!! LOL!!!

I'm off to work..have a great day what ever part of the world you are in !!!

Dar

Hi,

Good to hear that you have the disks for Word and Excel. We may need them.

When you get the log for ESET be sure to post that so we can get a look.

As for the snow….send it my way! I haven't seen a real snow in years since I lived in Boston!

I am in TN so I don't see much snow here. So pass it along

When you get ESET post the log.

Jeff

we got about 4-5 inches of snow…packed and shipped directly to your front door, courtesy of all of us in the Burgh!

We stayed home tonight, and I've been running this scan now for 2 1/2 hours and counting. I took a screen shot and attached it.

I'll be shutting this down in 50 min, if it's not done, I'll have to stop it and restart it sunday when I'm home all day. We are going to Cleveland Oh at 6 am - so won't have time to run this till sunday.

I will check in at 5:30 am before we leave.

thanks for your help!

dar

I am in TN so I don't see much snow here. So pass it along

When you get ESET post the log.

\
Jeff - I had to stop it - time to head to bed….

cya sunday

dar

I am in TN so I don't see much snow here. So pass it along

When you get ESET post the log.

I had to stop it - time to head to bed….

Ok no problem….just run it through when you get a chance.

Morning from icy Monroeville!

Ran the scan and went to bed!
Here are the results:

C:\Program Files\Trend Micro\Internet Security\Temp\VS060GCE.OR7 Win32/RiskWare.PEMalform.B application
C:\Program Files\Trend Micro\Internet Security\Temp\VS060HN9.81G Win32/RiskWare.PEMalform.B application
C:\Program Files\Trend Micro\Internet Security\Temp\VSJ41A4S.006 Win32/RiskWare.PEMalform.B application
C:\Program Files\Trend Micro\Internet Security\Temp\VSLL18CU.013 Win32/RiskWare.PEMalform.B application
C:\Program Files\Trend Micro\Internet Security\Temp\VSOM0V2U.O0K Win32/RiskWare.PEMalform.B application
C:\Program Files (x86)\iBryte\browseforchange\uninstall.exe a variant of MSIL/Adware.iBryte.A application
C:\Users\DARLENE'S\AppData\Local\Google\Chrome\User Data\Default\Default\aagedjdagbdddggcgddfdjdhdegfgcdf\background.html Win32/BHO.OEI trojan
C:\Users\DARLENE'S\AppData\Local\Google\Chrome\User Data\Default\Default\aagedjdagbdddggcgddfdjdhdegfgcdf\ContentScript.js Win32/BHO.OEI trojan
C:\Users\DARLENE'S\AppData\Roaming\Mozilla\Firefox\Profiles\rs6a0nlk.default\extensions\[removed] JS/Redirector.NCA trojan


Hope to hear from you soon!

dar

Hi,

Yes that was the parts of the ZeroAccess rootkit that were on your system.

Question - my TrendMicro is due for renewal at the end of March. Is there a better anti virus out there that may have caught this nasty thing?

I prefer either Microsoft Security Essentials or Avast antivirus. They are both very good antivirus programs and are free of charge.
——–

You say you are having problems with Word not opening? With this infection, the possibility of breaking bits and pieces of your system is very possible. It is possible that this is what may have happened but I can't be absolutely sure. Do you have the installation disk for Microsoft Office or did Word come pre-installed on your system? Go to Start > Control Panel > Programs and Features and see if Microsoft Live Add-In 1.3 is on your system.
——–

[external image: Posted Image]Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.

There is an exploit of Java out right now that has no fix presently. I would recommend keeping Java off of your system completely until this issue has been resolved by Oracle.
————-

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.

———-

Hi there,

ComboFix

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:
  

  
  ClearJavaCache::
  
  File::
  C:\Program Files\Trend Micro\Internet Security\Temp\VS060GCE.OR7
  C:\Program Files\Trend Micro\Internet Security\Temp\VS060HN9.81G
  C:\Program Files\Trend Micro\Internet Security\Temp\VSJ41A4S.006
  C:\Program Files\Trend Micro\Internet Security\Temp\VSLL18CU.013
  C:\Program Files\Trend Micro\Internet Security\Temp\VSOM0V2U.O0K
  C:\Users\DARLENE'S\AppData\Local\Google\Chrome\User Data\Default\Default\aagedjdagbdddggcgddfdjdhdegfgcdf\background.html
  C:\Users\DARLENE'S\AppData\Local\Google\Chrome\User Data\Default\Default\aagedjdagbdddggcgddfdjdhdegfgcdf\ContentScript.js
  C:\Users\DARLENE'S\AppData\Roaming\Mozilla\Firefox\Profiles\rs6a0nlk.default\extensions\[removed]
  
  Folder::
  C:\Program Files (x86)\iBryte
  

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  [external image: Posted Image]
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix may request an update; please allow it.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Post the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Post the new ComboFix log and let me know what remaining malware problems you are having.

thanks Jeff! I'm off to work now..so I will do this tonight!! Have a great day! Dar

You too.

Good Evening Jeff!

I have attached the log.txt file from combo fix - looks greek to me!

dar

Hi there,

ComboFix

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:
  

  
  ClearJavaCache::
  
  File::
  C:\Program Files\Trend Micro\Internet Security\Temp\VS060GCE.OR7
  C:\Program Files\Trend Micro\Internet Security\Temp\VS060HN9.81G
  C:\Program Files\Trend Micro\Internet Security\Temp\VSJ41A4S.006
  C:\Program Files\Trend Micro\Internet Security\Temp\VSLL18CU.013
  C:\Program Files\Trend Micro\Internet Security\Temp\VSOM0V2U.O0K
  C:\Users\DARLENE'S\AppData\Local\Google\Chrome\User Data\Default\Default\aagedjdagbdddggcgddfdjdhdegfgcdf\background.html
  C:\Users\DARLENE'S\AppData\Local\Google\Chrome\User Data\Default\Default\aagedjdagbdddggcgddfdjdhdegfgcdf\ContentScript.js
  C:\Users\DARLENE'S\AppData\Roaming\Mozilla\Firefox\Profiles\rs6a0nlk.default\extensions\[removed]
  
  Folder::
  C:\Program Files (x86)\iBryte
  

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  [external image: Posted Image]
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix may request an update; please allow it.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Post the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Post the new ComboFix log and let me know what remaining malware problems you are having.

Good Morning Jeff! I've been meaning to tell you, that since we started this cleansing routine, this laptop makes a sound…out of nowhere it does a bleeping windows sound. there is never any box to alert me that something is going on - nothing, just the sound. Any ideas on this one? dar

Hi,

We still have a couple that want to hang around so let's remove them.

Run a new scan with DDS and post that please.

In addition to my previous post, I would also like for you to do the following:

Go to your Desktop and delete your ComboFix icon by dragging it to the Recycle Bin.
Once done, please Empty Your Recycle Bin.

Let me know when this is done.