What I meant with "marked for deletion" was that FRST listed them as they should be deleted - not that the are marked for deletion by NTFS.
Yes, the files respawn with the same name every time, but the name itself seems to be generated randomly (what is a knwon behaviour of many infections.)
Sorry for misunderstanding the youtube video - I thought you´ve removed something depending on the instructions within the vid.
I apologize! (Truth to tell there are sometimes people who try do fix their machines with these tools on their own - that´s why we are a bit sensible for such things).
I´ll reply as soon as I have the files analyzed. Please be patient with me in the meantime.
Open notepad (Start =>All Programs => Accessories => Notepad).
Please copy the entire contents of the code box below.
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Save it to the same direction as frst.exe (or frst64.exe) as fixlist.txt.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
Run frst.exe (on 64bit, run frst64.exe) and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.
Scan with ESET Online Scan
Please go to here to run the online scannner from ESET.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Click Scan
Wait for the scan to finish
If any threats were found, click the 'List of found threats' , then click Export to text file….
Save it to your desktop, then please copy and paste that log as a reply to this topic.
The message I received via email is different than the message posted here. After running FRST64, the email says to run MalwareBytes. The post here says to run Eset. Which is correct?
Here is fixlog.txt:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-12-2013
Ran by [removed] at 2013-12-02 02:28:01 Run:1
Running from E:\download\Farbar
Boot Mode: Normal
==============================================
I just discovered that the files giiynunu.mau and zmlomobd.kxh are recreated by some program that runs during my reboot sequence (could be anything that is autorun). Also, it is not anything recently added to my computer as backups from a couple months ago show these files present.
Do you know of a file watcher that would give the process name of the creating process? The one I have (DirectoryMonitor) only tells me that the file was created.
Following are the results of the eset scan, with some comments from me interspersed:
Comment: The following 4 reports are of some concern to me. Do you know of a reason not to just delete them?
C:\Users\howard\AppData\Local\Bundled software uninstaller\bi_client.exe Win32/Somoto.A application
C:\Users\howard\AppData\Local\FilesFrog Update Checker\update_checker.exe a variant of Win32/Somoto.D application
C:\Users\howard\AppData\Local\Temp\OfferBrokerage_14111.exe a variant of Win32/InstallIQ.A application
C:\Users\howard\AppData\Local\Temp\UpdateCheckerSetup.exe a variant of Win32/Somoto.D application
Comment: I have seen many posts that Nirsoft software is unjustiably accused of being malware. This entry does not concern me at all.
D:\Program Files\Nirsoft\wirelessnetview\WirelessNetView.exe probably a variant of Win32/PSWTool.WirelessNetView.A application
Comment: All of the files stored in "E:\download" are the original installer files. I realize that some applications contain attempts to get you to install other software. None of these files are executed unless I install the program, and I always say "No" to additional software. (All of the installer files passed Norton AV, or I wouldn't have installed them.) Some of these are installers for well-known commercial software (e.g., Nero, Epson printer tools
E:\download\CrystalDiskMark\CrystalDiskInfo5_6_2-en.exe Win32/OpenCandy application
E:\download\CrystalDiskMark\CrystalDiskMark3_0_2f-en.exe Win32/OpenCandy application
E:\download\EaseUS\tb_free.exe a variant of Win32/TFTPD32.A application
E:\download\epson\wf7520\epson14460.exe a variant of Win32/Bundled.Toolbar.Ask.D application
E:\download\FileMenuTools\FileMenuTools-setup6_5.exe Win32/InstallMonetizer.AF application
E:\download\FreeFileSync\FreeFileSync_5.18_Windows_Setup.exe Win32/OpenCandy application
E:\download\izarc\IZArc4.1.6.exe Win32/OpenCandy application
E:\download\izarc\IZArc4.1.7.exe a variant of Win32/Somoto.A application
E:\download\Nero\Nero-7.10.1.0_eng_update.exe Win32/Toolbar.AskSBar application
E:\download\syncios\syncios.exe Win32/OpenCandy application
E:\download\unlocker\cbsidlm-tr1_14-Unlocker-ORG-10493998.exe Win32/DownloadAdmin.G application
Comment: This is my email attachment directory. I just deleted this file. It's not something I ever clicked on.
Comment: This does concern me. Wish the scanner told me which running program contained Somoto.
Operating memory a variant of Win32/Somoto.D application
Comment: The following 4 reports are of some concern to me. Do you know of a reason not to just delete them?
No - uninstall the tools they belong to/remove the files.
Comment: I have seen many posts that Nirsoft software is unjustiably accused of being malware. This entry does not concern me at all.
It is not detected as malware but as a Network Monitoring tool. That´s ok, no action is needed. This is only for users who don´t know what these programs are able to do.
Comment: All of the files stored in "E:\download" are the original installer files. I realize that some applications contain attempts to get you to install other software. None of these files are executed unless I install the program, and I always say "No" to additional software. (All of the installer files passed Norton AV, or I wouldn't have installed them.) Some of these are installers for well-known commercial software (e.g., Nero, Epson printer tools
You´re right - none of these files contain malware. ESET has just discovered potential unwanted software installations within these instalelrs or classified them as special administrative tools.
I would recommend to uninstall the tools mentioned in your first comment, then run the following tools:
Delete junk with adwCleaner
Please download AdwCleaner to your desktop.
Run adwcleaner.exe
Hit Scan and wait for the scan to finish.
Confirm the message but don´t uncheck anything.
Hit Clean
When the run is finished, it will open up a text file
Please post its contents within your next reply
You´ll find the log file at C:\AdwCleaner[S1].txt also
Delete junk with JRT
[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
These programs are written by malware removal team members and will remove only things that are identified/classified as adware by the internal database.
I found the FilesFrogUpdateChecker it my Add/Remove programs list. Tried to remove it. Got a popup that said FilesFrogUpdateChecker has stopped working. Don't know if it uninstalled - got no confirmation of uninstallation.
For these three:
C:\Users\howard\AppData\Local\Bundled software uninstaller\bi_client.exe Win32/Somoto.A application
C:\Users\howard\AppData\Local\Temp\OfferBrokerage_14111.exe a variant of Win32/InstallIQ.A application
C:\Users\howard\AppData\Local\Temp\UpdateCheckerSetup.exe a variant of Win32/Somoto.D application
I don't see anything in the Add/Remove Programs list that would correspond, and I don't know what program generated the files.
AdwCleaner Log (what it cleaned looks all good to me):
# AdwCleaner v3.014 - Report created 03/12/2013 at 02:07:26
# Updated 01/12/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : howard - QUAD64
# Running from : E:\download\adwcleaner\adwcleaner.exe
# Option : Clean
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by [removed] on Tue 12/03/2013 at 2:20:12.89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 12/03/2013 at 2:24:54.36
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
C:\Users\howard\AppData\Local\Bundled software uninstaller\bi_client.exe Win32/Somoto.A application
C:\Users\howard\AppData\Local\Temp\OfferBrokerage_14111.exe a variant of Win32/InstallIQ.A application
C:\Users\howard\AppData\Local\Temp\UpdateCheckerSetup.exe a variant of Win32/Somoto.D application
Latest ESET scan. As before, all of the items in e:\download are just installers. The 18146d.msi is not a new file - it's dated 1/18/2011 - so it may be a new addition to the scanning database. It also may be a false positive as it's identified as part of Ancestry.Com's Family Tree Maker 2011, which is an application I have installed. Neither Norton nor MalwareBytes thinks it's malicious.
C:\Windows\Installer\18146d.msi a variant of Win32/HiddenStart.A application
D:\Program Files\Nirsoft\wirelessnetview\WirelessNetView.exe probably a variant of Win32/PSWTool.WirelessNetView.A application
E:\download\CrystalDiskMark\CrystalDiskInfo5_6_2-en.exe Win32/OpenCandy application
E:\download\CrystalDiskMark\CrystalDiskMark3_0_2f-en.exe Win32/OpenCandy application
E:\download\EaseUS\tb_free.exe a variant of Win32/TFTPD32.A application
E:\download\epson\wf7520\epson14460.exe a variant of Win32/Bundled.Toolbar.Ask.D application
E:\download\FileMenuTools\FileMenuTools-setup6_5.exe Win32/InstallMonetizer.AF application
E:\download\FreeFileSync\FreeFileSync_5.18_Windows_Setup.exe Win32/OpenCandy application
E:\download\izarc\IZArc4.1.6.exe Win32/OpenCandy application
E:\download\izarc\IZArc4.1.7.exe a variant of Win32/Somoto.A application
E:\download\Nero\Nero-7.10.1.0_eng_update.exe Win32/Toolbar.AskSBar application
E:\download\nirsoft\wirelessnetview\wirelessnetview.zip probably a variant of Win32/PSWTool.WirelessNetView.A application
E:\download\syncios\syncios.exe Win32/OpenCandy application
E:\download\unlocker\cbsidlm-tr1_14-Unlocker-ORG-10493998.exe Win32/DownloadAdmin.G application