Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

IE8 Redirected


  • This topic is locked This topic is locked

#16
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
Hi,

Tell your friend to post his issue in this forum and I or some other helper will help him as every infection is different and have to be treated individually.

Please do this now:

Download AVPTool from Here to your desktop

Run the program you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan
  • On the first tab select all elements down to Computer (included) and then select start scan
  • Once it has finished select report and post that.

Posted Image

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan
  • Select the Manual Disinfection tab
  • Press the Gather System Information button
  • Once done Open the last report saved folder then attach the zip file to your next post zip
  • The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

Posted Image

How to add an attachment to a new topic or reply
  • 0

Advertisements


#17
Rickles

Rickles

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 612 posts
Hi Render,

As instructed:

Autoscan: completed <1 minute ago (events: 6, objects: 199829, time: 00:49:19)
3/06/2011 5:57:35 PM Task completed
3/06/2011 5:37:37 PM Deleted: Packed.Win32.Krap.hc C:\System Volume Information\_restore{764F37E8-835B-4CA2-B9F0-8C2FD237CDF1}\RP2\A0001062.exe
3/06/2011 5:36:55 PM Detected: Packed.Win32.Krap.hc C:\System Volume Information\_restore{764F37E8-835B-4CA2-B9F0-8C2FD237CDF1}\RP2\A0001062.exe
3/06/2011 5:21:05 PM Deleted: Trojan-Downloader.Java.Agent.me C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\37db3fe2-586e3e14
3/06/2011 5:20:23 PM Detected: Trojan-Downloader.Java.Agent.me C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\37db3fe2-586e3e14
3/06/2011 5:08:16 PM Task started

The program did find something as a red notice popped up asking to delete it and I confifmed and then clicked the box to do the same with anything else it found.

As this is the first time I can remeber attaching a file I hope it works but I will save it.

Regards

Attached Files


  • 0

#18
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
Hi,

Please proceed with this:

  • Re-run AVPTool
  • Select the Manual Disinfection tab
  • Where it states Step 3 paste in the following disinfection script and press Execute

    begin
    SetAVZPMStatus(True);
    SearchRootkit(true, true);
    SetAVZGuardStatus(True);
     DelBHO('{710EB7A1-45ED-11D0-924A-0020AFC7AC4D}');
    BC_ImportDeletedList;
    ExecuteSysClean;
    BC_Activate;
    RebootWindows(true);
    end.
  • Your system will reboot on completion, if it does not please do so yourself
  • On completion please run another analysis scan and attach the zip file

Posted Image
  • 0

#19
Rickles

Rickles

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 612 posts
Hi Render,

Followed your instructions.

As requested:

Autoscan: stopped 3 hours ago (events: 2, objects: 2, time: 00:00:15)
3/06/2011 11:55:53 PM Task stopped
3/06/2011 11:55:35 PM Task started
Autoscan: completed 1 hour ago (events: 2, objects: 203046, time: 02:02:47)
3/06/2011 11:56:10 PM Task started
4/06/2011 1:58:57 AM Task completed

Regards

Attached Files


  • 0

#20
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
Your logs shows that your system is clean. If you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

Removing the tools we used:

Reset System Restore points:

  • Please reopen Posted Image on your desktop.
  • Copy (select all lines inside quote box and press CTRL+C) and Paste (press CTRL+V) the following code into the Posted Image textbox.

    :Commands
    [ClearAllRestorePoints]

  • Click on Posted Image button.
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click on Posted Image button.

NEXT...

OTL Clean-Up:

  • Reopen Posted Image on your desktop.
  • Click on Posted Image
  • You will be prompted to reboot your system. Please do so.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.


There are a few things I recommend you to do once your computer is completely clean:

Updates for Windows - One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically.

How to turn on Automatic Updates for Windows:

Java and Adobe Reader updates

There are certain programs that are security vulnerabilities, it is recommended that you keep everything updated. Two of the main vulnerabilities are Java and Adobe Reader.

Java Updates - Java needs to be regularly updated to fix security vulnerabilities. You can download the latest version of the Java Runtime Environment (JRE) from here. Download, install and reboot your computer. You also need to uninstall older versions of Java:

  • Click Start
  • Select Control Panel
  • Select Add or Remove Programs
  • Remove all Java updates except the latest one you have just installed.

Update Adobe Acrobat Reader to latest version. You can download it HERE.

Suggestion:

Foxit is a great free PDF alternative. It uses fewer system resources and is not vulnerable to the exploits affecting Adobe Reader. Providing full PDF functionality, Foxit is rapidly becoming the PDF reader of choice for many. Get it here.


Other Software Updates - Go HERE to scan your computer for any out of date software at least once per week. The vast majority of virus, worm and spyware infections could have been prevented, if the user had kept their software up-to-date. You should do everything you can to keep your software up-to-date. Doing so will help you prevent infections and the headaches that follow them.

Web Browsers - Picking the right internet browser is very important. You need to find one that suits your needs but that is also safe. All browsers listed below are far more secure than Internet Explorer, immune to almost all known browser hijackers, and also have the best built-in pop up blockers.

Although, if you prefer staying with Internet Explorer I highly recommend you do this :

Make Internet Explorer more secure:
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the options Download signed and unsigned ActiveX controls to Prompt, and Initialize and Script ActiveX controls not marked as safe to Disable.
  • Next click OK, then Apply button and then OK to exit the Internet Properties page.

Tips to protect yourself against malware and reduce the potential for re-infection:

Now after all these steps, your PC will be more secure. However it is important to note that you can still get infected if you are not careful. One of the best security programs you can have is common sense. As malware gets more sophisticated, you need to be more wary. If you do get caught though and the above steps can't help prevent it, we will be here to help you out.

Stay secure and thank you for choosing GeeksToGo.
  • 0

#21
Rickles

Rickles

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 612 posts
Hi Render,

Followed your instructions:

========= COMMANDS ==========
Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.23.0 log created on 06052011_165858

I already use Foxit to read PDFs and I shall look at the Mozilla and Chrome and your other suggestions.

Thank you for your help and time and I am always thankful that a site like Geeks exists.

Regards
  • 0

#22
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
You are welcome and let me know if you have any other questions.
  • 0

#23
Render

Render

    Trusted Helper

  • Malware Removal
  • 4,195 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP