I opened a PDF, how can i tell if I am infected? [Solved]

I overlooked a couple of things with the last fix so please run it again.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine\22.19.8.65\buShell.dll [2019-09-11] (Symantec Corporation -> Symantec Corporation)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
C:\Users\Hannah_2\AppData\Local\Temp\iMesh_setup.exe
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

===================================================

Run Malwarebytes

Please try to run Malwarebytes again following the previous instructions.

If it still fails, try running it in Safe mode.

Logs to include with next post:

fixlist.txt
Mbam.txt

Satchfan

Your computer seems to be fine but let’s run one more scan.

Run Emsisoft Emergency Kit

Please download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A folder named EEK will be created in the root of the drive (usually c:\).

• after extraction, double-click on the new Start Emsisoft Emergency Kit icon on your desktop
• the first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates: click Yes so that it downloads the latest database updates
• when update the is complete, click Malware Scan. When asked if you want the scanner to scan for Potentially Unwanted Programs, click Yes. Emsisoft Emergency Kit will start scanning
• when the scan has completed click Quarantine selected objects. Note, this option is only available if malicious objects were detected during the scan
• when the threats have been quarantined, click the View report button in the lower-right corner and the scan log will open in Notepad
• please save the Notepad log on your desktop and post the contents in your next reply
• when you close Emsisoft Emergency Kit it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.

Satchfan

Thank you for all your help.  Have you seen evidence that my computer was attacked/infected?

Here is the Emsisoft log:

Have you seen evidence that my computer was attacked/infected?

No.

Your computer appears to be clean so let’s tidy up what we’ve used and I’ll supply a few recommendations.

===================================================

Run KpRm

Download KpRm by kernel-panik and save it to your desktop.

• right-click kprm_(version).exe and select Run as Administrator.
• when the tool opens, ensure all boxes are checked, and select Run.
• once completed, click OK.
• a log will open in Notepad titled kprm-(date).txt.
• please copy and paste its contents in your next reply.

===================================================

Update installed programs

Your versions of Java and Adobe Reader are out-of-date and need to be removed and updated.

Having the latest updates and removing old versions ensures there are no security vulnerabilities in your system.

To remove them:

• click Start, Control Panel, Programs and Features.
• click on each of these programs, one at a time, name and then on Uninstall:

Java 8 Update 151
Adobe Flash Player 10
Adobe Reader 9.5.1

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Go here and download the latest version of Flash Player.

Note: Before you hit the Download now button, uncheck the Chrome offer if it’s not something you want.

NEXT

Visit Adobe and download the latest version of Acrobat Reader.

NEXT

Install the latest version of Java:

Java

NOTE – when you install Java, before clicking on Install, be sure to Uncheck “Install the Ask Toolbar and make Ask my default search provider”

Even though I just had you get the latest version of Java, there is a vulnerability with regards to Java and web browsers. Therefore, we recommend to disable java in web browsers.

More information can be found here.

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

======================

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

======================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

======================

Unchecky

Be careful when downloading free software. Many free programs come bundled with adware, many of which cause redirects/popups and verge on being malware. There is a program that automatically “unckecks” the boxes you may not notice when downloading programs.

Download and install Unchecky .

======================

Download and install CryptoPrevent

Crypto Ransomware Warning

There are particularly nasty “Ransomware” infections out there at the moment that encrypt your files and the only way possible to get them “de-crypted” is to pay a ransome. You can read more about this here.

• download CryptoPrevent
• save the file to your Desktop and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
• accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This will launch the program once you click Finish
• you will get a prompt asking if you purchased a Product Key for Automatic Updates. Click No
• you will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to
• click OK to continue and select your protection level. Go ahead and click OK.
• click the Apply button to set Default protection
• you may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.

You are now protected.

Note: The free version doesn't provide automatic updates but should be updated often, (at least weekly), as this infection has serious consequences. To update it manually, open the program, select the “Updates” menu then select Check for Updates to see if there are any available.

===================================================

I also recommend that you read the following:

Best Practices for Safe Computing - Prevention of Malware Infection by miekiemoes

Simple and easy ways to keep your computer safe and secure on the Internet  by Lawrence Abrams

I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan

Looks like CryptoPrevent deleted their free version.  

Was my system compromised between the time I opened that file and when we completed the processes that we did here?

No

Looks like CryptoPrevent deleted their free version

Apologies, they did.

The paid version of Malwarebytes however, will do a good job of keeping you protected from pretty much anything that your antivirus misses. Go to the Malwarebytes website which supplys all the information: I would suggest that you subscribe to the Premium version which is a cheap price to pay for the protection it gives.

Satchfan

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.