I have noticed that whenever I reboot or turn on my computer, I receive a notification that Windows Defender has found some malware and is removing it. Each time I have viewed the details in Windows Defender, it as listed Trojan Win32/Vigorf.A I have removed it each time yet it still shows up.
Today I googled the term and the information I read indicates this is a serious issue and can make your personal information vulnerable. At the beginning of March, I had a fraudulent charge made on my Ebay and paid for with my Paypal account using my checking account.
There is no way I can correct this and remove this threat from my computer with my IT skill set. I registered as a user on this site. I have downloaded and run the two scans you indicated in your instructions and I am including them with this post. I would appreciate any direction you can give me.
Trojan Win32/Vigorf.A [Solved]
4 min read
![]()
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 3/26/17
Scan Time: 10:50 AM
Logfile:
Administrator: Yes
-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.75
Update Package Version: 1.0.1601
License: Trial
-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: System
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 531195
Time Elapsed: 27 min, 50 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 0
(No malicious items detected)
Physical Sector: 0
(No malicious items detected)
(end)
Lets see what these two programs pick up
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next reply.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
- Download the one from Bleeping Computer
- Shut down your protection software now to avoid potential conflicts.
- Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete depending on your system's specifications.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
I downloaded both these programs to my desktop. I ran AdwCleaner and will post the results. When I opened the second program, Junkware Removal Tool, the program opened, I received a message it was requesting a restore point, and then my computer suddenly powered off. I was unsuccessful on getting the computer to power up on two subsequent attempts. The third time, it did boot up. I'm hesitant to attempt running the Junkware Removal Tool again. Can you tell me why this caused my computer to shut down?
# AdwCleaner v6.044 - Logfile created 26/03/2017 at 18:14:29
# Updated on 28/02/2017 by Malwarebytes
# Database : 2017-03-23.2 [Server]
# Operating System : Windows 10 Home (X64)
# Username : User - DASH2
# Running from : C:\Users\User\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\Public\Documents\pc faster
[-] Folder deleted: C:\uninst
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojhmphdkpgbibohbnpbfiefkgieacjmh
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojhmphdkpgbibohbnpbfiefkgieacjmh
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocggccaacacpienfcgmgcihoombokbbj
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ocggccaacacpienfcgmgcihoombokbbj_0
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocggccaacacpienfcgmgcihoombokbbj
***** [ Files ] *****
[-] File deleted: C:\TOSTACK
[-] File deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ocggccaacacpienfcgmgcihoombokbbj_0.localstorage
[-] File deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ocggccaacacpienfcgmgcihoombokbbj_0.localstorage-journal
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKLM\SOFTWARE\WISECLEANER
[-] Key deleted: [x64] HKLM\SOFTWARE\WISECLEANER
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\viewpointforum.com
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\viewpointforum.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\viewpointforum.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\viewpointforum.com
***** [ Web browsers ] *****
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: us.search.yahoo.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: search.yahoo.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ocggccaacacpienfcgmgcihoombokbbj
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ojhmphdkpgbibohbnpbfiefkgieacjmh
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [3547 Bytes] - [26/03/2017 18:14:29]
C:\AdwCleaner\AdwCleaner[S0].txt - [3701 Bytes] - [26/03/2017 18:12:05]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [3693 Bytes] ##########
Not really sure, JunkwareRemoval is nice tool and I never ran into this before
Is Windows Defender still finding that bad file ?
I ran a full scan of Windows Defender after reading your last message. Oddly, my computer powered off during the scan. I turned it back on, it booted up and I ran a fast scan of Windows Defender. The trojan was not detected. I have restarted the computer a couple of times and haven't seen it turn up. I ran all of HP Diagnostics on all components and everything passed.
After running the HP Diagnostics, I ran the Junkware Removal Tool once again. My computer didn't power off this time. I have posted the results.
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.2 (03.10.2017)
Operating System: Windows 10 Home x64
Ran by [removed] (Administrator) on Mon 03/27/17 at 4:52:45.33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 4
Successfully deleted: C:\Users\Public\thunder network (Folder)
Successfully deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol (Folder)
Successfully deleted: C:\WINDOWS\system32\Tasks\Wise Care 365.job (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\Wise Turbo Checker.job (Task)
Registry: 2
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B27D16AB-06C4-4A00-AE3E-1690CF6C34CC} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{B27D16AB-06C4-4A00-AE3E-1690CF6C34CC} (Registry Key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 03/27/17 at 4:56:20.86
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sounds like your PC is running better now with no shutdowns. What I would do is if you have the time is to shut down your pc ( not restart ) and leave it off for a half hour or so and then start it up .In the course of the day do this a few times and lets make sure your all clear on that issue.
The only real software we installed was the new version of Malwarebytes, it had a few minor bugs when it came out months back but they have been all taken care of. I like you have Win 10 and my malwarebytes is running fine with no issues.
AdwCleaner and Junkware removal just removed some garbage nothing real bad
Just use your pc for a few days and then post back and let me know how its running
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI