OMIGA-PLUS Virus [Solved]

Also, that file you uploaded to VirusTotal is the Fixlog, not the file i asked you to upload

 

C:\Program Files (x86)\Common Files\7bd3e3d7-3f18-4e2f-8da9-12acd7334a7f.dll <—This file

Hopefully this is it, if not please let me know.

 

Thanks,

 

Brian

 

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
Ran by [removed] at 2015-02-07 17:10:07 Run:1
Running from C:\Users\[removed]\Desktop
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HomePage: Default -> hxxp://isearch.omiga-plus.com/?type=hppp&ts=1421326357&from=ild&uid=ST500DM002-1BD142_W3T3J4GK
CHR RestoreOnStartup: Default -> "hxxp://rts.dsrlte.com?affID=pr_953af01d-e3af-45d4-ab39-472d2beb9084"
2015-01-15 07:45 - 2015-02-04 07:49 - 00001344 _____ () C:\windows\Tasks\VRRFE.job
2015-01-15 07:45 - 2015-01-15 07:49 - 02010592 _____ () C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe
2015-01-15 07:45 - 2015-01-15 07:49 - 00004378 _____ () C:\windows\System32\Tasks\VRRFE
Task: {C41A48CE-A95F-4631-B488-5814B9277253} - System32\Tasks\VRRFE => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe [2015-01-15] () <==== ATTENTION
Task: C:\windows\Tasks\VRRFE.job => C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe <==== ATTENTION
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
End

 

 

 

 

*****************

Processes closed successfully.
C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
Chrome HomePage deleted successfully.
Chrome RestoreOnStartup deleted successfully.
C:\windows\Tasks\VRRFE.job => Moved successfully.
C:\Users\WRRUBIS\AppData\Roaming\VRRFE.exe => Moved successfully.
C:\windows\System32\Tasks\VRRFE => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C41A48CE-A95F-4631-B488-5814B9277253}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C41A48CE-A95F-4631-B488-5814B9277253}" => Key deleted successfully.
C:\Windows\System32\Tasks\VRRFE not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\VRRFE" => Key deleted successfully.
C:\windows\Tasks\VRRFE.job not found.

=========  ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 1.4 GB temporary data.

The system needed a reboot.

==== End of Fixlog 17:11:13 ====

Great, thank you. I still need you to upload that file I asked for so I can see if its bad and needs removal

 

https://www.virustotal.com/en/file/f1097f0472907d42f6fe5d170327513826e56b103b961f55479a7ff5a59e2be4/analysis/1423587887/

The greater percentage of Anti Virus programs found it ok but you can right click on it and select Delete, leave it in your Recycle Bin for about a week,  if any programs pop up saying its missing or if you get an error message on start up that its missing then just go back to your Recycle Bin and restore it.

 

How is your system behaving now ??

The system is working perfectly!!!!  You cleaned it up almost immediately.  It has not given any more trouble and seems to be back to normal.  I will leave the file in the recycle bin as you suggested and see if anything pops up, but apart from that we are happy and relieved you were able to solve our problem.

 

Thanks again,

 

Brian

 

Thats great, what i like to do is just keep this thread open for you for maybe 3 days, post back if anything returns, if after the thread is closed and you have some issues just send me a PM and I will reopen it for you

 

 

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.