"Sponsorship" virus/longfintuna [Solved]

is it ok to uninstall all the programs you had me download? or should i keep them still?

Hello veramitude,

is it ok to uninstall all the programs you had me download? or should i keep them still?

We will do this later.

—————————————-

1. Uninstall old versions:

• Please go to Start > Control Panel > Add Remove Programs.
• Locate the following program:
  
• Adobe Reader 10
• Uninstall it.

2. Install latest Adobe Acrobat Reader:

• Go to http://get.adobe.com/reader/otherversions/
• Use the drop down menu's to select your operating system
• Select your language > Select The current version of Adobe Reader for your language
• Remove the check mark from the box "Install Chrome as standard browser and Google Toolbar for Internet explorer"
• Click the Download button, and follow the onscreen directions to complete the installation.

3. Restart your pc.

How the computer is running now? Are there any other problems?

i am currently installing adobe 11, but there was never a box involving the chrome browser that you mentioned. i did uncheck something about mcafee though.

Hello veramitude,

well done.

IT APPEARS THAT YOUR PC IS NOW CLEAN!

————————————————-

Clean up:

We used Combofix.

• Deactivate your antivirus software once more, then rename the combofix.exe to uninstall.exe and run it one last time.
• You shall be noted that Combofix has been removed.
  
• Enable your antivirus software.

Right-click AdwCleaner.exe and select Run As Administrator.

• Click on the Uninstall button.
• A window will open, press the Confirm button.
• AdwCleaner will uninstall now.

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :Files
  c:\users\veramitude\Downloads\JRT.exe
  c:\users\veramitude\Downloads\SecurityCheck.exe
  c:\users\veramitude\Downloads\aswMBR.exe
  
  :Commands
  [emptytemp]

• Close all other programs apart from OTL as this step may require a reboot
• Then click the Run Fix button at the top
• Let the program run unhindered.
• Say Yes to the prompt and then allow the program to reboot your computer.

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

Delete the log files our tools created; they are located at your desktop or at the "c:\users\veramitude\Downloads" folder.
Highlight them, and press the del or delete key on the keyboard.
You can browse to the location of the file or folder using either My Computer or Windows Explorer .

————————————————-

Here are some Preventive tips to reduce the potential for spyware infection in the future:

1. Browse more secure
WOT - Know which websites to trust
Web of Trust - this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam.
2. Enable Protected Mode in Internet Explorer.

• This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
  
• Open Internet Explorer
• Click on Tools > Internet Options
• Press Security tab
• Select Internet zone then place check next to Enable Protected Mode if not already done
• Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
• Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Make sure you keep your Windows OS current.

• Windows XP users can visit Windows update regularly to download and install any critical updates and service packs.
• Windows Vista / 7 users can update via
  Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane).

4. Avoid P2P

• If you think you're using a "safe" P2P program, only the program is safe, not the data.
• You will share files from unsafe sources, and these may be infected.
• Some bad guys use P2P filesharing as an important chanel to spread their wares.

5. Use only one anti-virus software and keep it up-to-date.

6. Firewall
Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

7. Backup regularly
You never know when your PC will become unstable or become so infected that you can't recover it.

8. Use Strong passwords!

9. Email attachments
Do not open any unknown email attachments, which you received without asking for it!


Extra note:
Keep your Browser, Java, pdf Reader and Adobe Flash Up to Date.
Make sure your programs are up to date - because older versions may contain Security Leaks.
To find out what programs need to be updated, please run the Secunia Software Inspector Scan. http://secunia.com/software_inspector/

how do i rename combofix? I've right clicked and renamed it, as that's the only thing i knew to do. But that seems to not do anything significant. Combofix starts running and tries to update to a new version, rather than uninstall.

Hello veramitude,

please rename it back to ComboFix.exe

Full path should be:

c:\users\veramitude\Downloads\ComboFix.exe

Press the Windows key + R and this will open the Run text box. Copy/paste the following text into the Run box and click OK:

c:\users\veramitude\Downloads\ComboFix.exe /Uninstall

(Note: There is a space between the ..exe and the /U that needs to be there.)

Hi, it has been several days since I sent my last set of instructions to help with your computer problem. Please let me know if you are having problems and still need help. Note: Threads will be closed if no response after 3 days.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Re-opened at topic starters request.

my topic was closed but I am still having problems with uninstalling things. I apparently stopped receiving email notifications at some point that Jo had responded in the topic, and checked just now but it had been closed. Can some one help me with the final steps?

Hi Jo, i asked for this to be reopened as I am still having trouble with uninstalling. I have renamed combofix back to ComboFix.exe and copied and pasted the uninstall c prompt line into "run", but the computer doesn't find anything so I'm still doing something wrong or missing some step. You quoted at one point what the full line should read for combofix, but how do I view that whole name for combo fix? I never find a way to view the c: name of it. The second problem now is that since it had been a few days, I thought I had completed the steps prior to "cleap up" on otl. But soon realized I didn't do any of the steps. SO I think i accidentally uninstalled OTL without copying and pasting the code into the window and running it. How bad is that? Sorry this is taking so long- I'm finding I don't know much about computers after all.

Hello veramitude,

look in the Downloads folder and see if ComboFix is still there. If it is, delete it and get a new copy.

Download ComboFix from here:

Link

* IMPORTANT- Save ComboFix.exe to your Desktop

Using Internet Explorer - right click the link and click Save target as. Make sure the Save as box is set to Desktop and click Save.

Does this work for you?

If yes, go on with Clean up:

Press the Windows key + R and this will open the Run text box. Copy/paste the following text into the Run box as shown and click OK.

Combofix /Uninstall

(Note: There is a space between the ..x and the /U that needs to be there.)

🖼Click to load external image (Posted Image)

ok so i got the new combofix saved, copied the text and entered it into "run" and it started going, but now it keeps asking me if I want to abort, retry, or ignore because it keeps finding "error opening file for writing" I'm just ignoring for now I guess.

also Combofix's blue screen came up and said: " ' SWREG' is not recognized as an internal or external command, operable program or batch file" and I have no idea what to do with that

Hello veramitude,

use Internet Explorer to download this tool and save it to your Desktop like you did when you downloaded combofix.

You will now have a file on your Desktop named CF_UNINST.EXE.
Right click it and click "Run as Adminstrator".

Let the tool run, it should remove combofix and all of it's components. Let us know how you make out.

well, I saved target to desktop. Ran as administrator. It ran and said it was done, but combo fix is still on my desktop and works.