Hello jobobens.
Please read the following warnings before you proceed:
[external image: goGMWSt.gif]BACKDOOR WARNING
——————————
One or more of the identified infections is known to use a backdoor, that allows attackers to remotely control your computer, download/execute files and steal system, financial & personal information.
If your computer has been used for online banking, has credit card information or other sensitive data, using a non-infected computer/device you should immediately change all account information (including those used for Email, eBay, Paypal, online forums, etc).
Banking and credit card institutions should be notified of the possible security breach. Please read the following article for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
Whilst the identified infection(s) can be removed, there is no way to guarantee the trustworthiness of your computer unless you reformat your Hard Drive and reinstall your Operating System. This is due to the nature of the infection, which allows a remote attacker to make any number of modifications. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat/reinstall. Please read the following articles for more information.
- When should I re-format? How should I reinstall?
- Help: I Got Hacked. Now What Do I Do?
- Where to draw the line? When to recommend a format and reinstall?
You now have the choice between cleaning the infection(s) present or reformatting your computer. Ultimately, the decision is personal, and what you're most comfortable with. Once you've read the articles linked above, let me know if you have any questions, and how you wish to proceed.
[external image: goGMWSt.gif]P2P Warning
——————————
I see you have peer-to-peer (P2P) file sharing software installed on your computer (uTorrent). I advise you avoid P2P file sharing programmes; they are a security risk which can make your computer susceptible to malware. File sharing networks are thoroughly infested with malware - worms, backdoor Trojans, IRCBots, and rootkits propagate via P2P file sharing networks, gaming, and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install malware. The best way to reduce the risk of infection is to avoid these types of web sites and P2P programmes. Please read the following articles for more information.
- Risks of File-Sharing Technology
- P2P Software User Advisories
- More malware is traveling on P2P networks these days
Your P2P software can be removed by following the instructions below.
- Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
- Search for the aforementioned programme(s), right-click and click Uninstall. Follow the prompts.
If you choose not to, please refrain from using the programme(s) during this process.
Please tell me in your next reply if you want to keep Hotspot Shield.
It is a potentially unwanted program, because you agree in the privacy policy to advertisments while receiving not much that is useful in turn.
AnchorFree allows other companies, called third-party ad servers or ad networks, to serve advertisements within the Service. These third-party ad servers or ad networks use technology to send, directly to your browser, the advertisements and links that appear on the Service.
The backdoor on your system seems to stem from a minecraft plugin. We need to remove minecraft to clean your computer.
To backup your saved games, please do the following:
- Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type %appdata%\.minecraft and click OK.
- The explorer will open and you will see a folder called saves, drag that folder to your desktop.
STEP 1
[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Script
- Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
- Copy the entire contents of the codebox below and paste into the Notepad document.
start
CreateRestorePoint:
2015-07-19 16:50 - 2014-09-01 11:19 - 00000000 ____D C:\Users\Dyllan Goldstein\AppData\Roaming\.minecraft
FF Extension: Ebay Shopping Assistant by Spigot - C:\Users\Dyllan Goldstein\AppData\Roaming\Mozilla\Firefox\Profiles\nnunalv8.default\Extensions\{CA8C84C6-3918-41b1-BE77-049B2BDD887C} [2015-02-01]
HKU\S-1-5-21-2147853320-1309280057-1922023414-1001\…\Run: [Java Update] => "C:\Program Files (x86)\Java\jre1.8.0_45\bin\javaw.exe" -jar "C:\Users\Dyllan Goldstein\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaUpdate.jar"
HKU\S-1-5-21-2147853320-1309280057-1922023414-1001\…\Run: [JavaUpdate] => C:\Users\Dyllan Goldstein\uylol.jar [36287 2014-09-27] ()
Startup: C:\Users\Dyllan Goldstein\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaUpdate.jar [2014-09-16] ()
C:\Users\Dyllan Goldstein\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaUpdate.jar
C:\Users\Dyllan Goldstein\uylol.jar
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
FF Plugin HKU\S-1-5-21-2147853320-1309280057-1922023414-1001: @hola.org/vlc,version=1.8.131 -> C:\Users\Dyllan Goldstein\AppData\Local\Hola\firefox\app\vlc No File
EmptyTemp:
end
- Click File, Save As and type fixlist.txt as the File Name.
- Important: The file must be saved in the same location as FRST64.exe.
NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.
- Right-Click FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
- Click Fix.
- A log (Fixlog.txt) will open on your desktop. Attach the log in your next reply.
======================================================
STEP 2
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to attach the requested logs, as well as provide information on any questions I may have asked.
- Do you want to keep Hotspot Shield?
- Fixlog.txt
