Homepage hijacked

Good deal

The most recent version of Java can be found here
http://java.com/en/download/

If you haven't done so already let's take care of this now.


~~~~~~~~~~~~~~

Please run a Threat Scan with Malwarebytes' Anti-Malware.

Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now… link

Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  
  Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

~~~~~~~~~~~~~`

What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
Most reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.


[external image: GzlsbnV.png]ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme.
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click [external image: esetListThreats.png]. If no threats were found, skip the next two bullet points.
• Click [external image: esetExport.png] and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to [external image: xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png] and click [external image: SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png].
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.

How is Computer #2 doing now?

Hi Juliet,

I cannot run Java for some reason, there is no executable. Windows keeps asking for a program to open the file (Java) that I downloaded.

Here are the scan results from Malwarebytes and Eset.

 

Thanks,

Kevin

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18/02/2015
Scan Time: 7:17:10 PM
Logfile: malwarebytes scan.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.18.04
Rootkit Database: v2015.02.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: kevin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 519703
Time Elapsed: 8 min, 59 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.BrowserExtensions.A, HKU\S-1-5-21-1126716267-3827778198-1193308169-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\BROWSER EXTENSIONS, , [cf439585aedc4de9664abddfbd466a96],
PUP.Optional.Softonic.A, HKU\S-1-5-21-1126716267-3827778198-1193308169-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Softonic, , [48ca9e7c5238c3730018f6a643c06f91],

Registry Values: 1
PUP.Optional.BrowserExtensions.A, HKU\S-1-5-21-1126716267-3827778198-1193308169-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\BROWSER EXTENSIONS|SS_Ver, 2.2, , [cf439585aedc4de9664abddfbd466a96]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

 

C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\Button.exe.vir Win32/Toolbar.Widgi.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\Button64.exe.vir Win64/Toolbar.Widgi.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\ButtonWrap.dll.vir Win32/Toolbar.Widgi.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\ButtonWrap64.dll.vir Win64/Toolbar.Widgi.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\Coupons.dll.vir a variant of Win32/Toolbar.Widgi.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\Coupons64.dll.vir a variant of Win64/Toolbar.Widgi.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\coupons_3.3.xpi.vir JS/Adware.Spigot.A application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\saamazon_1.8.xpi.vir JS/Adware.Spigot.A application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\saebay_1.8.xpi.vir JS/Adware.Spigot.A application
C:\AdwCleaner\Quarantine\C\Users\Emma 2\AppData\Roaming\Browser Extensions\Uninstall.exe.vir a variant of Win32/Toolbar.Widgi.H potentially unwanted application
C:\FRST\Quarantine\C\Users\kevin\AppData\Local\Temp\AskSLib.dll.xBAD a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\Program Files (x86)\FlashFXP\Uninstall.exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\Program Files (x86)\Vuze\.install4j\user\mism.exe Win32/Toolbar.Conduit.AP potentially unwanted application
C:\Users\Aaron 2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\2fa9ab43-239902d1 a variant of Java/Exploit.CVE-2013-0422.AC trojan
C:\Users\Aaron 2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\886ee3c-5f94e38a a variant of Java/Exploit.CVE-2013-0422.AC trojan
C:\Users\kevin\Desktop\SetupImgBurn_2.5.1.0.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\Windows\System32\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
E:\$RECYCLE.BIN\S-1-5-21-1126716267-3827778198-1193308169-1005\$RX50QF3.7\3DS Emulator 1.1.7.exe a variant of MSIL/Hoax.Agent.NAP application
E:\Aarons torrent downloads\3DS Emulator 1.1.7.rar a variant of MSIL/Hoax.Agent.NAP application
E:\Aarons torrent downloads\SetupImgBurn_2.5.6.0.exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
E:\Utilities\FlashFXP_36_Setup.exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
E:\Utilities\isobuster_eng.exe a variant of Win32/Toolbar.Conduit.B potentially unwanted application
E:\Utilities\SetupImgBurn_2.5.1.0.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
E:\Utilities\nero 10 multimedia suite\NMMS10\ISSETUPP\{BF80A1C\TOOLBAR.EXE a variant of Win32/Bundled.Toolbar.Ask.A potentially unsafe application
E:\Utilities\nero 10 multimedia suite\N£ro 10 Multimedia Suite RETAIL + Keyz\nero10ms.iso a variant of Win32/Bundled.Toolbar.Ask.A potentially unsafe application
 

Hi Juliet,

Apparently IE11 blocks the executable at this stage Java developers are looking into it, so I used Google Chrome to D/L I have successfully installed Java 8.

 

Thanks,

Kevin

These torrent downloads are going to kill your computers. Not trying to be rude or ugly but think ahead if it's really that important to have the downloads.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start ->type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

@echo off
del /f /s /q "C:\Program Files (x86)\FlashFXP\Uninstall.exe" 
del /f /s /q "C:\Program Files (x86)\Vuze\.install4j\user\mism.exe"
del /f /s /q "C:\Users\Aaron 2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\2fa9ab43-239902d1"
del /f /s /q "C:\Users\Aaron 2\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\886ee3c-5f94e38a"
del /f /s /q "C:\Users\kevin\Desktop\SetupImgBurn_2.5.1.0.exe"
del /f /s /q "C:\Windows\System32\Adobe\Shockwave 12\gt.exe"
del /f /s /q "C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe"
del /f /s /q "E:\$RECYCLE.BIN\S-1-5-21-1126716267-3827778198-1193308169-1005\$RX50QF3.7\3DS Emulator 1.1.7.exe"
del /f /s /q "E:\Aarons torrent downloads\3DS Emulator 1.1.7.rar"
del /f /s /q "E:\Aarons torrent downloads\SetupImgBurn_2.5.6.0.exe"
del /f /s /q "E:\Utilities\FlashFXP_36_Setup.exe"
del /f /s /q "E:\Utilities\isobuster_eng.exe"
del /f /s /q "E:\Utilities\SetupImgBurn_2.5.1.0.exe"
del /f /s /q "E:\Utilities\nero 10 multimedia suite\NMMS10\ISSETUPP\{BF80A1C\TOOLBAR.EXE"
del /f /s /q "E:\Utilities\nero 10 multimedia suite\N£ro 10 Multimedia Suite RETAIL + Keyz\nero10ms.iso"
del %0 

Save the Notepad file on your desktop…as delfile.bat… save type as "All Files"



It should look like this: 🖼Click to load external image (batfileicon.gif)<–XP[external image: vista_bat_icon.png]<–vista

• Double click on delfile.bat to execute it.
  A black CMD window will flash, then disappear…this is normal.
• The files and folders, if found…will have been deleted and the "delfile.bat" file will also be deleted.

How is the computer now?

Hi Juliet,

Computer seems better, no issues with Bitdefender.

 

Regards,

Kevin

Good deal. We can finish this out and send you on your way

[external image: AFZxnZc.jpg] DelFix

• Please download DelFix
  or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
• Click the Run button.

– This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).



~~~~~~~~~~~~~~~~`

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
  
  

The following programmes come highly recommended in the security community.

• [external image: xKsUqI5A.png.pagespeed.ic.vn1Hlvqi8h.jpg]AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• [external image: E8I37RF.png]CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
• [external image: EG85Vjt.png]Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• [external image: x6YRrgUC.png.pagespeed.ic.HjgFxjvw2Z.jpg]Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• [external image: xjv4nhMJ.png.pagespeed.ic.A5YbWn1eDO.png]NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• [external image: 3O8r9Uq.png] Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• [external image: DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png]Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• [external image: xj1OLIec.png.pagespeed.ic.k6hhwopU0q.jpg]SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• [external image: xJEP5iWI.png.pagespeed.ic.4tmM1lM7DQ.png]Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

Hi Juliet,

Thanks for all your help. Computer is behaving fine, have installed Adblock.

Can you tell me if it was adware that infected my computers, as we only noticed a problem after visiting travel website.

 

Thanks,

Kevin

Hi Juliet,
Thanks for all your help. Computer is behaving fine, have installed Adblock.
Can you tell me if it was adware that infected my computers, as we only noticed a problem after visiting travel website.
 
Thanks,
Kevin

I believe it was more then just adware but pointed more toward viral.

It's possible the website had an injected code they didn't know about that creates an open exploit for your machine. If certain applications are not the most current/recent version it can affect any computer.
Thats why it's critical to run all patches from Microsoft and big names like Java and Adobe (there are others but it's very early in the morning) IF it entered that way.
[external image: DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png]Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.

Glad we could help. [external image: sparkle.gif]

Since this issue appears resolved … this Topic is closed.