zeus virus [Solved]

There is no sign of malware on your computer but there are some issues that need to be addressed.


You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\1361\g2ax_winlogonx64.dll [X]
S2 GoToAssist Remote Support Customer; "C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\1361\g2ax_service.exe" "Start=service" [X]
U3 aswMBR; C:\Users\Susan\AppData\Local\Temp\aswMBR.sys [62728 2017-08-08] () [File not signed] <==== ATTENTION
U3 aswVmm; C:\Users\Susan\AppData\Local\Temp\aswVmm.sys [224896 2017-08-08] () <==== ATTENTION
AdAwareInstaller (HKLM\…\{59AF2B50-3BF4-470D-AF23-6D20EB18268A}) (Version: 12.1.856.11526 - adaware) Hidden
AdAwareUpdater (HKLM\…\{BE1507DA-170B-4E3E-BD8E-513ECC6E59D7}) (Version: 12.1.856.11526 - adaware) Hidden
AntimalwareEngine (HKLM\…\{06D33B93-9458-4E28-BDEA-F5ECB2C3C30E}) (Version: 3.0.144.0 - adaware) Hidden
Task: {5995BCE4-9680-470D-AA06-47EC922377E3} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Multiple antiviruses

You have Ad-Aware and McAfee antivirus programs installed.

You can not run two real-time antiviruses at the same time. Although many have different methods of searching for and recognising threats, they will all be 'fighting' in memory to kick each other out, rendering them all ineffective.

I would suggest you uninstall Ad-Aware but it is your choice.

• click Start, Control Panel, Programs and Features
• scroll down the list click on either Ad-Aware or McAfee and then on Remove.

================================================

Run Security Check

Download Security Check by screen317 from here.

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

Logs to include with next post:

Fixlog.txt
checkup.txt

Thanks

Satchfan

That doesn't appear to be the full 'fixlist'.

According to you security log Windows Defender is running. It is unlikely as McAfee should have automatically disabled it but please check that it is turned off.

Turn Windows Defender On or Off in Windows 10

================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

New Frst.txt
New Addition.txt

Thanks

Satchfan

That looks better: just a few bits to get rid of.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
2017-08-06 16:35 - 2017-08-06 16:35 - 000000000 ____D C:\Users\Susan\AppData\Local\GoToAssist Remote Support Customer
2017-07-29 15:47 - 2017-07-29 15:47 - 000000000 ____D C:\Users\Susan\AppData\Local\AdAwareDesktop
2017-07-29 15:45 - 2017-07-29 15:45 - 000000000 ____D C:\Users\Susan\AppData\Local\AdAwareUpdater
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
Task: {5995BCE4-9680-470D-AA06-47EC922377E3} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Any remaining problems?

Satchfan

Please post the complete 'fixlog' and let me know if there are any remaining problems.

Thanks

Satchfan

That was all that was in the fixlog.  there doesn't seem to be any other problems

Your computer appears to be clean.

As long as it seems to be running well, please follow these simple steps to tidy up your computer and decrease the likelihood of getting infected:

Uninstall AdwCleaner

• double click on adwcleaner.exe to run the tool
• click on Uninstall
• confirm with Yes.

===================================================

Download & run Delfix

• download Delfix from here to remove many of the tools we've used during the cleaning process.
• ensure “Remove disinfection tools” is checked.

Also place a checkmark next to:

o    Create registry backup
o    Purge system restore

• click the Run button.

You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Download and run the installer for Malwarebytes 3.0 then follow the prompts to install the program.

This really is an excellent program that you should update and run on a regular basis, probably weekly.

======================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

======================

Download WOT

Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

green if it's safe
yellow for caution
red for unsafe
 

You can download the WOT add-on for Firefox, Chrome, Internet Explorer, Opera, and Safari browsers. It does not slow down your browsing experience, it is easy to use and free. Just click “Download” and you are ready to go!

======================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

A couple of links with information here and here which can answer any questions you might have about installing/using it.

======================

Unchecky

Be careful when downloading free software. Many free programs come bundled with adware, many of which cause redirects/popups and verge on being malware. There is a program that automatically “unckecks” the boxes you may not notice when downloading programs.

Download and install Unchecky .

===================================================

I also recommend that you read the following:

Best Practices for Safe Computing - Prevention of Malware Infection by miekiemoes

Simple and easy ways to keep your computer safe and secure on the Internet  by Lawrence Abrams

I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.