What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Police e-crime virus [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I can't do the last step. I've searched the C drive and all I can find is ejz6hr.pad.vir in the C:\qoobox\quarantine folder. Do you mean that one? It doesn't sound great when it has the letters 'vir' in it!!!
Post #18

all I can find is ejz6hr.pad.vir in the C:\qoobox\quarantine folder

That's quite safe there and will disappear when we tidy up at the end.

Can you tell me what problems remain.

.
Post #19
All seems to be fine now. Just lots of virus checker software and files dotted about! Thanks for your help. Looked like a nasty virus not easy to remove!
Post #20 last edited

lots of virus checker software and files dotted about!

We'll tidy that up when we are finished. ;)

This was/is a very nasty infection that’s on your computer so we’re not quite clear yet and need some more scans before we can be sure it has gone.

Download Malwarebytes-Anti-Malware

Click here.
  • double-click mbam-setup.exe and follow the prompts to install the program.
  • at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
  • if an update is found, it will download and install the latest version.
  • once the program has loaded, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

Run Security Check

Download Security Check by screen317 from here or here.

  • save it to your Desktop.
  • double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • a Notepad document should open automatically called checkup.txt; please post the contents of that document.
Logs to include with the next post:

Mbam.txt
checkup.txt

Thanks

Satchfan
Post #21
I ran malware bytes and it didn't find anything so nothing to remove. Here is the report: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.05.10.03 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Peter :: STONE-PC [administrator] 10/05/2013 10:00:10 mbam-log-2013-05-10 (10-00-10).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 247770 Time elapsed: 21 minute(s), 42 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ************* will do next step now and post another reply.
Post #22
Here is the security check report:

Results of screen317's Security Check version 0.99.63
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 21
Adobe Reader 9 Adobe Reader out of Date!
Google Chrome 26.0.1410.43
Google Chrome 26.0.1410.64
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 7 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
Post #23
One final scan should do it and if that's clear, we can tidy up.

This scan can take a while so don't sit around waiting for it to finish. ;)

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan
  • click the Eset online Scanner button.
  • for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)


    o click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
    o double click on the Eset installer icon on your desktop.

  • check Yes, I accept the Terms of Use
  • click the Start button.
  • accept any security warnings from your browser.
  • check Scan archives and Remove found threats.
  • click Advanced settings and select the following:


    o Scan potentially unwanted applications
    o Scan for potentially unsafe applications
    o Enable Anti-Stealth technology

  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • when the scan completes, push List of found threats
  • push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

    Note - if ESET doesn't find any threats, no report will be created.
  • push the back button.
  • push Finish
If a log has been produced post it in your next reply.

Thanks

Satchfan
Post #24
Hi I'm running the Eset scan but…..in your instructions at the top you say uncheck remove all threats but later you say check remove all threats. I've unchecked it. Will post report later.
Post #25
Here is the eset report, 3 threats found: C:\Qoobox\Quarantine\C\ProgramData\rh6zje.dat.vir Win32/Reveton.R trojan C:\Users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\6ef15991-4d3fc39f Java/Exploit.Agent.OCD trojan C:\Users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\28fb3243-5ddd40e8 Java/Exploit.Agent.NQR trojan
Post #26
Hi Peter, just about there. :)

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
Folder::
C:\Users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe


Please let me know if you have any remaining problems.

Satchfan
Post #27
Hi
I tried to run combofix on my desktop but it said it had expired. So downloaded it again calling it combofix2.
Ran it ok. Here is the report:

ComboFix 13-05-11.01 - Peter 11/05/2013 11:09:58.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2938.1375 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix2.exe
Command switches used :: c:\users\Peter\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\31684a00-164ddb6b
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\31684a00-164ddb6b.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\b25060b-3c5b3c86
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\b25060b-3c5b3c86.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\23a8d78c-4b8dea6f
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\23a8d78c-4b8dea6f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\6969b8d-530f9840
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\6969b8d-530f9840.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\6eb635cd-196bde8a
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\6eb635cd-196bde8a.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\25f8728f-38eeb772
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\25f8728f-38eeb772.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\713e8f0f-523ca6d8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\14761410-2c3a6602
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\14761410-2c3a6602.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\6ef15991-4d3fc39f
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\6ef15991-4d3fc39f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\42943052-4c02a75f
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\42943052-4c02a75f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\6f5a1cd2-54eb93db
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\6f5a1cd2-54eb93db.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\17f30fd3-718120e7
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\17f30fd3-718120e7.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\4b7ee142-3d882be3
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\4b7ee142-3d882be3.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\5a8fb014-19e39f9e
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\5a8fb014-19e39f9e.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\11ada816-2a16149c.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\716a8ad7-57eea6d9
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\716a8ad7-57eea6d9.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\791905d7-6a0d2efb
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\791905d7-6a0d2efb.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\5dbfa998-13283cf4-0307.0009.2009.1013-
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\5dbfa998-13283cf4-0307.0009.2009.1013-.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\332d1c99-3bb1bfa2
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\332d1c99-3bb1bfa2.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\3703a75a-43dfd31c
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\3703a75a-43dfd31c.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\46252edb-3781566b
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\46252edb-3781566b.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\4e971db-79c42439
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\4e971db-79c42439.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\726dec5d-5159c2f4
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\726dec5d-5159c2f4.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\28fb3243-5ddd40e8
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\28fb3243-5ddd40e8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\6862811e-598722d3
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\6862811e-598722d3.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\2b7c1fe0-42e0678f
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\2b7c1fe0-42e0678f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\7f89d21-5fa542a1
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\7f89d21-5fa542a1.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\26fc35e2-23518a95
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\26fc35e2-23518a95.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\45439463-22d0a101
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\45439463-22d0a101.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\80c063-1ae84fa5
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\80c063-1ae84fa5.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\2d70e9a4-37dc6914
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\2d70e9a4-37dc6914.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\bdef266-6ec94418
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\bdef266-6ec94418.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\35dea9e7-55c28ce3
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\35dea9e7-55c28ce3.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\43b67d27-432f5e9c
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\43b67d27-432f5e9c.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\629d7467-29e389ec
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\629d7467-29e389ec.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\38f7ea6a-257aee10
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\38f7ea6a-257aee10.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\33806aeb-3fa62342
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\33806aeb-3fa62342.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\1ac0522e-65331fae
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\1ac0522e-65331fae.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\7ff8aaee-23c629d1.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\7ff8aaee-7c5cf6d9.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\1f33feaf-69e199e7
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\1f33feaf-69e199e7.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\34027f6f-118a2519
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\34027f6f-118a2519.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\34239b70-5ea162b3
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\34239b70-5ea162b3.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\37b01c31-57d4da2d
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\37b01c31-57d4da2d.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\48fb0071-34e4e4f6
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\48fb0071-34e4e4f6.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\51a333f1-29648351
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\51a333f1-29648351.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\56cd03f1-659c4b86
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\56cd03f1-659c4b86.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\731e5831-3ab356d8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\7ba47ef1-238b7539
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\7ba47ef1-238b7539.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\2dde4b05-304a3cac
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\2dde4b05-304a3cac.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\74f64245-7f9baafc
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\74f64245-7f9baafc.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\197d5033-1d5cab67
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\197d5033-1d5cab67.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\28ed0376-534e68f8
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\28ed0376-534e68f8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\448ffa76-1da095ba
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\448ffa76-1da095ba.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\718ffff6-6607c70f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\44282638-1bd44e50
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\44282638-1bd44e50.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\3cd59379-69375505.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\6c49387a-372e40d8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\370cc57b-6d0fe88d
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\370cc57b-6d0fe88d.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\4311ebbb-34d0283f
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\4311ebbb-34d0283f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\66099246-25fb25ff.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\171c107c-4e22f843
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\171c107c-4e22f843.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\51f1b5bc-45d501d8
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\51f1b5bc-45d501d8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\5cdf68fc-6b88d2bb
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\5cdf68fc-6b88d2bb.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\7a0dd13c-350b0bbf
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\7a0dd13c-350b0bbf.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\16fdc07f-15386a74
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\16fdc07f-15386a74.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\3c4ec3bf-33b72e4f
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\3c4ec3bf-33b72e4f.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\1004f08-180112f8
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\1004f08-180112f8.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\1004f08-6.0.lap
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\4930d149-5c767fc0
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\4930d149-5c767fc0.idx
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\102f78d5-279c5a51.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\1225ebb5-24cd7bf5.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-2ad03b2c.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-39c46bbd.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-40c3b21f.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-6036d6e9.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-77bc1f27.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-785069f5.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\13b7ce79-7e387210.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\1b362dfb-518f3826.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\1bee44ef-6f0e686f.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\21f6416b-5a8326f0.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\21f6416b-6f6ed2be.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\22ad4e50-55906ee8.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\23f6bd61-135b69c0.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\287855e9-3802a5a3.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\2a48f359-574a46d1.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\2c003437-26195725.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\2ec5fff-6641f286.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\3021ab89-765aeca5.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\31658ec0-14aec5a0.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\3450fa0a-4f034e3d.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\35f6785c-5c56f938.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\37dbd2ae-50706755.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\37dbd2ae-5cce84cf.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\3d3f01ca-3d9482ed.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\3e51f125-6b211727.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\41251fb7-77dc8396.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\43472b0d-3e68a5f5.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\462398b1-7462414c.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\4724a0ed-11232fd2.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\4aadbbd5-4831b0f1.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\4ba35d6-4a0ec01c.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\4bceead6-7ab41bd7.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\4cad6728-15352361.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\4f959ed0-3e85bb9a.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\532f0e8b-3e664f5d.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\54e0d9ad-5a344607.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\558652c5-2d0581f4.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\5bba5020-63ed175e.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\5db80a13-217981f0.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\61dd3348-190d1ae3.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\63a303c3-454c8288.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\6530c192-7dddd46f.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\67573695-1081f55c.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\71ae0a5b-2d8e0ed1.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\7448fa3e-666a4826.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\744c4497-512378c2.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\75f41c9e-4e832297.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\7818afa0-557225fc.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\7c50db0e-5021af62.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\7e78c3f1-43dc0a38.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\7e78c3f1-48c39c6b.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\940e82c-1a6aef9d.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\97409ef-4349839a.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\aaa2b16-53a103e5.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\c066c97-6b38490d.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\c59145a-2e56abc2.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\dea346d-6ca5dbcc.hst
c:\users\Peter\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\lastAccessed
.
.
((((((((((((((((((((((((( Files Created from 2013-04-11 to 2013-05-11 )))))))))))))))))))))))))))))))
.
.
2013-05-11 10:25 . 2013-05-11 10:25 ——– d—–w- c:\users\Jane\AppData\Local\temp
2013-05-11 10:25 . 2013-05-11 10:25 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-05-10 13:48 . 2013-05-10 13:48 ——– d—–w- c:\program files\ESET
2013-05-10 08:58 . 2013-05-10 08:58 ——– d—–w- c:\users\Peter\AppData\Roaming\Malwarebytes
2013-05-10 08:58 . 2013-05-10 08:58 ——– d—–w- c:\programdata\Malwarebytes
2013-05-10 08:58 . 2013-05-10 08:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2013-05-10 08:58 . 2013-04-04 13:50 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2013-05-09 09:27 . 2013-05-09 09:31 ——– d—–w- C:\Update
2013-05-09 09:04 . 2013-05-09 09:04 ——– d—–w- c:\program files\Common Files\Java
2013-05-09 09:04 . 2013-05-09 09:03 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-07 15:57 . 2013-05-11 10:26 ——– d—–w- c:\users\Peter\AppData\Local\temp
2013-05-04 12:59 . 2013-05-04 12:59 ——– d—–w- c:\users\Peter\AppData\Local\ArcSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-09 09:03 . 2013-03-04 10:54 866720 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-05-09 09:03 . 2013-03-04 10:54 788896 —-a-w- c:\windows\system32\deployJava1.dll
2013-03-12 20:35 . 2012-07-01 09:34 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-12 20:35 . 2011-05-17 13:56 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-12 20:35 . 2013-03-12 20:35 15859416 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-03-11 13:25 . 2013-04-10 19:44 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-10 19:44 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-10 19:44 49152 —-a-w- c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-10 19:44 64000 —-a-w- c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-10 19:44 376320 —-a-w- c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-10 19:44 2067968 —-a-w- c:\windows\system32\mstscax.dll
2013-03-05 01:40 . 2013-04-10 19:44 2049024 —-a-w- c:\windows\system32\win32k.sys
2013-03-03 19:07 . 2013-04-10 19:44 1082232 —-a-w- c:\windows\system32\drivers\ntfs.sys
2013-02-22 03:46 . 2013-04-11 02:09 1800704 —-a-w- c:\windows\system32\jscript9.dll
2013-02-22 03:38 . 2013-04-11 02:09 1129472 —-a-w- c:\windows\system32\wininet.dll
2013-02-22 03:37 . 2013-04-11 02:09 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2013-02-22 03:34 . 2013-04-11 02:09 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2013-02-22 03:34 . 2013-04-11 02:09 420864 —-a-w- c:\windows\system32\vbscript.dll
2013-02-22 03:31 . 2013-04-11 02:09 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2013-02-12 01:57 . 2013-03-12 20:55 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-11-05 270336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 6295552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-22 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-22 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-22 145944]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-21 30192]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 317280]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2009-06-17 24576]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Skytel"="Skytel.exe" [2008-10-17 1826816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Event Planner Reminder 2009.lnk - [N/A]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-06 01:32 98304 —-a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-11 07:39 1642448 —-a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 10:24]
.
2013-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
2013-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/webhp?rlz=1W1SNYW&ie=UTF-8&oe=UTF-8
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-11 11:26
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2013-05-11 11:30:00
ComboFix-quarantined-files.txt 2013-05-11 10:29
ComboFix2.txt 2013-05-07 15:57
ComboFix3.txt 2013-05-07 15:13
ComboFix4.txt 2013-05-06 19:30
ComboFix5.txt 2013-05-11 10:05
.
Pre-Run: 49,648,816,128 bytes free
Post-Run: 49,835,479,040 bytes free
.
- - End Of File - - 3C5AF2F458455650C88102CF6B4BBB55





Is it fixed now? No sign of it.
Post #28
As ComboFix dealt with the Eset finding, your computer now appears to be clean.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix
  • click START then RUN
  • now type Combofix /uninstall in the runbox and click OK.
Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)
  • please follow the prompts to uninstall Combofix.
  • once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================

Update installed programs

You have an old version of Adobe Reader on your computer which is vulnerable to infections.1. Click Start, Control Panel, Programs, and then Programs and Features.
2. Click on Adobe Reader 9 and then Uninstall.
Install the latest version:

Adobe Reader

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Install Spybot - Search and Destroy - Download and install Spybot Search and Destroy which provides real time spyware and hijacker protection .

You should scan your computer with the program on a regular basis as you would with your anti-virus software.

A tutorial on installing and using SS&D can be found here:

===================================================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

If I hear nothing for 24 hours I shall assume all is well and close the topic.

Safe computing

Satchfan
Post #29
Thanks for all your help. Can't believe it took so long to fix. This is a really nasty virus. Glad my laptop is back to normal. I've uninstalled Combofix and updated Adobe. I'll have a look at the other things to install too. Thanks again Peter
Post #30

Thanks for all your help.

You're welcome. :)

Can't believe it took so long to fix. This is a really nasty virus.

It is indeed and you were lucky that you came for help so soon. I've seen cases where it's a lot worse and the computer has become unbootable.


I forgot to add that you can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

Regards

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI