This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan Win32/Vigorf.A [Solved]

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I have noticed that whenever I reboot or turn on my computer, I receive a notification that Windows Defender has found some malware and is removing it.  Each time I have viewed the details in Windows Defender, it as listed Trojan Win32/Vigorf.A  I have removed it each time yet it still shows up.
 
Today I googled the term and the information I read indicates this is a serious issue and can make your personal information vulnerable.  At the beginning of March, I had a fraudulent charge made on my Ebay and paid for with my Paypal account using my checking account.
 
There is no way I can correct this and remove this threat from my computer with my IT skill set. I registered as a user on this site. I have downloaded and run the two scans you indicated in your instructions and I am including them with this post.  I would appreciate any direction you can give me.

:welcome:

Open Windows Defender
     
  • Go to History Tab
  • Select Quarantined Items >  View Details
  • Check everything and select REMOVE all
  • Close Windows Defender
  •  
     
     
    You have Malwarebytes installed, upgrade to the new version 3.0.6 , no need to uninstall the old one , the new install will do that for you
     
     
    Download Malwarebytes' Anti-Malware  TO YOUR DESKTOP
     
    • Windows XP : Double click on the icon to run it.
    • Windows Vista, Windows 7 , 8, 8.1 and 10 : Right click and select "Run as Administrator"
    •  
      [external image: 3.0.6_zps4qucu0yg.jpg]
       
       
      • After the installation IS complete let it update if it asks.
      • Under SETTINGS…..APPLICATIONS leave everything at default
      • Under SETTINGS…..PROTECTION make sure AUTOMATIC QUARANTINE is on. 
      • Then go to the Dashboard and click on SCAN NOW
      • When the scan is finished click on EXPORT SUMMARY……COPY TO CLIPBOARD
      • Then come back to this thread and and under REPLY TO THIS TOPIC, right click in the reply and select Paste
      • Then click on POST
      • Exit Malwarebytes
      • Malwarebytes
        www.malwarebytes.com

        -Log Details-
        Scan Date: 3/26/17
        Scan Time: 10:50 AM
        Logfile:
        Administrator: Yes

        -Software Information-
        Version: 3.0.6.1469
        Components Version: 1.0.75
        Update Package Version: 1.0.1601
        License: Trial

        -System Information-
        OS: Windows 10
        CPU: x64
        File System: NTFS
        User: System

        -Scan Summary-
        Scan Type: Threat Scan
        Result: Completed
        Objects Scanned: 531195
        Time Elapsed: 27 min, 50 sec

        -Scan Options-
        Memory: Enabled
        Startup: Enabled
        Filesystem: Enabled
        Archives: Enabled
        Rootkits: Disabled
        Heuristics: Enabled
        PUP: Enabled
        PUM: Enabled

        -Scan Details-
        Process: 0
        (No malicious items detected)

        Module: 0
        (No malicious items detected)

        Registry Key: 0
        (No malicious items detected)

        Registry Value: 0
        (No malicious items detected)

        Registry Data: 0
        (No malicious items detected)

        Data Stream: 0
        (No malicious items detected)

        Folder: 0
        (No malicious items detected)

        File: 0
        (No malicious items detected)

        Physical Sector: 0
        (No malicious items detected)


        (end)

        Lets see what these two programs pick up

         

         
        -AdwCleaner-by Xplode
         
        Click on this link to download : ADWCleaner TO YOUR DESKTOP
         
        Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
         
        [external image: AdwCleaner4.201_zpsxrbk2llq.jpg]
         
         
        •  
        • Close all open programs and internet browsers.
        • Double click on AdwCleaner.exe to run the tool.
        • Click on Scan.
        • After the scan is complete click on "Clean"
        • Confirm each time with Ok.
        • Your computer will be rebooted automatically. A text file will open after the restart.
        • Please post the content of that logfile with your next reply.
        • You can find the logfile at C:\AdwCleaner[S1].txt as well.
         
         
         
        ===============================================================================
         
         
         
         
        [external image: Capture_zpsge1t2tk9.jpg] Please download Junkware Removal Tool TO YOUR DESKTOP
        •  
        • Download the one from Bleeping Computer
        • Shut down your protection software now to avoid potential conflicts.
        • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
        • The tool will open and start scanning your system.
        • Please be patient as this can take a while to complete depending on your system's specifications.
        • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
        • Post the contents of JRT.txt into your next message.
         

        I downloaded both these programs to my desktop. I ran AdwCleaner and will post the results.  When I opened the second program, Junkware Removal Tool, the program opened, I received a message it was requesting a restore point, and then my computer suddenly powered off.  I was unsuccessful on getting the computer to power up on two subsequent attempts.  The third time, it did boot up.  I'm hesitant to attempt running the Junkware Removal Tool again.  Can you tell me why this caused my computer to shut down?

         

        # AdwCleaner v6.044 - Logfile created 26/03/2017 at 18:14:29
        # Updated on 28/02/2017 by Malwarebytes
        # Database : 2017-03-23.2 [Server]
        # Operating System : Windows 10 Home  (X64)
        # Username : User - DASH2
        # Running from : C:\Users\User\Desktop\AdwCleaner.exe
        # Mode: Clean
        # Support : https://www.malwarebytes.com/support



        ***** [ Services ] *****



        ***** [ Folders ] *****

        [-] Folder deleted: C:\Users\Public\Documents\pc faster
        [-] Folder deleted: C:\uninst
        [-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojhmphdkpgbibohbnpbfiefkgieacjmh
        [-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojhmphdkpgbibohbnpbfiefkgieacjmh
        [-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocggccaacacpienfcgmgcihoombokbbj
        [-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ocggccaacacpienfcgmgcihoombokbbj_0
        [-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocggccaacacpienfcgmgcihoombokbbj


        ***** [ Files ] *****

        [-] File deleted: C:\TOSTACK
        [-] File deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ocggccaacacpienfcgmgcihoombokbbj_0.localstorage
        [-] File deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ocggccaacacpienfcgmgcihoombokbbj_0.localstorage-journal


        ***** [ DLL ] *****



        ***** [ WMI ] *****



        ***** [ Shortcuts ] *****



        ***** [ Scheduled Tasks ] *****



        ***** [ Registry ] *****

        [-] Key deleted: HKLM\SOFTWARE\WISECLEANER
        [-] Key deleted: [x64] HKLM\SOFTWARE\WISECLEANER
        [-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\viewpointforum.com
        [-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\viewpointforum.com
        [#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\viewpointforum.com
        [#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\viewpointforum.com


        ***** [ Web browsers ] *****

        [-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
        [-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: us.search.yahoo.com
        [-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: search.yahoo.com
        [-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
        [-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ocggccaacacpienfcgmgcihoombokbbj
        [-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: ojhmphdkpgbibohbnpbfiefkgieacjmh


        *************************

        :: "Tracing" keys deleted
        :: Winsock settings cleared

        *************************

        C:\AdwCleaner\AdwCleaner[C0].txt - [3547 Bytes] - [26/03/2017 18:14:29]
        C:\AdwCleaner\AdwCleaner[S0].txt - [3701 Bytes] - [26/03/2017 18:12:05]

        ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [3693 Bytes] ##########
         

        Not really sure, JunkwareRemoval is nice tool and I never ran into this before

         

        Is Windows Defender still finding that bad file ?

        I ran a full scan of Windows Defender after reading your last message.  Oddly, my computer powered off during the scan.  I turned it back on, it booted up and I ran a fast scan of Windows Defender.  The trojan was not detected.  I have restarted the computer a couple of times and haven't seen it turn up.  I ran all of HP Diagnostics on all components and everything passed. 

        After running the HP Diagnostics, I ran the Junkware Removal Tool once again.   My computer didn't power off this time.  I have posted the results.

         

        Junkware Removal Tool (JRT) by Malwarebytes
        Version: 8.1.2 (03.10.2017)
        Operating System: Windows 10 Home x64
        Ran by [removed] (Administrator) on Mon 03/27/17 at  4:52:45.33
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




        File System: 4

        Successfully deleted: C:\Users\Public\thunder network (Folder)
        Successfully deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol (Folder)
        Successfully deleted: C:\WINDOWS\system32\Tasks\Wise Care 365.job (Task)
        Successfully deleted: C:\WINDOWS\system32\Tasks\Wise Turbo Checker.job (Task)



        Registry: 2

        Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B27D16AB-06C4-4A00-AE3E-1690CF6C34CC} (Registry Key)
        Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{B27D16AB-06C4-4A00-AE3E-1690CF6C34CC} (Registry Key)




        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        Scan was completed on Mon 03/27/17 at  4:56:20.86
        End of JRT log
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

        Sounds like your PC is running better now with no shutdowns.  What I would do is if you have the time is to shut down your pc ( not restart ) and leave it off for a half hour or so and then start  it up .In the course of the day do this a few times and lets make sure your all clear on that issue.

         

        The only real software we installed was the new version of Malwarebytes, it had a few minor bugs when it came out months back but they have been all taken care of. I like you have Win 10 and my malwarebytes is running fine with no issues.

         

        AdwCleaner and Junkware removal just removed some garbage nothing real bad

         

         

        Just use your pc for a few days and then post back and let me know how its running 

        Double click on AdwCleaner.exe to run the tool again.
        • Click on the Uninstall button.
        • Click Yes when asked are you sure you want to uninstall.
        • Both AdwCleaner.exe, its folder and all logs will be removed.
        •  
           
          ==========================================================
           
           
          Open up Malwarebytes 
          • On the Quarantine Tab
          • Check all Threats 
          • Then click on Delete
          • Close out Malwarebytes
          •  
             
            ==========================================================
             
             
            Please download DelFix and save the file to your Desktop.
             
            [external image: DelFix_zps139e2ea1.jpg]
             
            • Windows XP Double Click DelFix.exe to run the program. 
            • Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR 
            • Checkmark " Remove Disinfection Tools"
            • Click the Run button
            •  
              This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually
               
               
               
               
              So How did I get infected in the first place <– Some reading for you to keep yourself safe online
               
               
              Safe Surfn
              Ken

              Ask AI

              AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

              Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI