Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Stealty, Persistent Malware Keeps Trying to Dial Out


  • This topic is locked This topic is locked

#16
SweetTech

SweetTech

    Sir SpamAlot

  • Retired Staff
  • 7,671 posts
Hi Jeff!

Your logs are looking good for the most part. I just see a few outdated programs that I'd like to have you update.

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy
  • Go to Start > Control Panel > Add/Remove Programs
  • Remove ALL instances of Adobe Reader
  • Re-boot your computer as required.
  • Once ALL versions of Adobe Reader have been uninstalled, visit: <<here>> and download the latest version of Adobe Reader
Alternative Option: after uninstalling Adobe Reader, you could try installing Foxit Reader from >here< Foxit Reader has fewer add-ons therefore loads more quickly.



NEXT:



Your version of Skype is outdated. I'd suggest updating to the latest version.



If there are no other isues with the computer, then the only thing we have to do is clean-up the tools we used, and I'll provide you with some final last words on how to stay safe and prevent an infection from happening again. Please let me know if you're ready to proceed with this step, or if there is some issue that requires attention.
  • 0

Advertisements


#17
Jeff_F

Jeff_F

    Member

  • Topic Starter
  • Member
  • PipPip
  • 27 posts
Hi SweetTech!

I'll go ahead and delete (Shift+Delete) the Northpointe website file (the whole folder, actually) and the old version of FolderLock, and the unused TestMyHardware, unless you recommend a safer way of removing them.

These are uneeded, and may contain fragments of malware even if they aren't active. Even if they are false positives, I can download the new version of FolderLock if I decide to use it, and the others are not needed.

***

I'm ready to remove the malware tools, unless you suggest keeping the free version of MalwareBytes and ditching the free version of SuperAntiSpyware instead. I have read a lot of praise for both MBAM and SAS, and it seems that AdAware and Spybot are coming back into favor after lagging behind other tools. Spy Sweeper was an early front runner when AntiSpyware was a new threat, and PCWorld has given it Editor's Choice numerous years running & it's a Checkmark Platinum Award winner, so I'll probably upgrade to the new version.

***

Removed Adobe Reader and decided to go with FoxIt, setting it to safe reading mode. Deleted Skype and updated to the new version. Hopefully I'll use it occasionally - I have some friends overseas I'd like to talk to.

In the past few years, I have become so busy with work that I don't have very much time to tweak my computer or use all of the software that I used to use or that I'd like to use. I generally use the computer to get work done, for my online college courses, or to blow off steam AND play a few old games when I somehow get a few minutes minutes to kill. I need to be more vigilant about updating software, that's for certain!

Sorry for spending your time and talents on what appears to be a security software bug and an odd set of coincidences that occurred simultaneously.
  • 0

#18
SweetTech

SweetTech

    Sir SpamAlot

  • Retired Staff
  • 7,671 posts
Good Evening Jeff!

I'll go ahead and delete (Shift+Delete) the Northpointe website file (the whole folder, actually) and the old version of FolderLock, and the unused TestMyHardware, unless you recommend a safer way of removing them.

These are uneeded, and may contain fragments of malware even if they aren't active. Even if they are false positives, I can download the new version of FolderLock if I decide to use it, and the others are not needed.

That's probably the best thing to do. I'd do the same thing if this were my computer.

I'm ready to remove the malware tools, unless you suggest keeping the free version of MalwareBytes and ditching the free version of SuperAntiSpyware instead. I have read a lot of praise for both MBAM and SAS, and it seems that AdAware and Spybot are coming back into favor after lagging behind other tools. Spy Sweeper was an early front runner when AntiSpyware was a new threat, and PCWorld has given it Editor's Choice numerous years running & it's a Checkmark Platinum Award winner, so I'll probably upgrade to the new version.

I'd keep the free version of MBAM. I'm a big fan of MBAM, and is a tool I use on my own personal computer.

In the past few years, I have become so busy with work that I don't have very much time to tweak my computer or use all of the software that I used to use or that I'd like to use. I generally use the computer to get work done, for my online college courses, or to blow off steam AND play a few old games when I somehow get a few minutes minutes to kill. I need to be more vigilant about updating software, that's for certain!

A little later in this post, you will find my All Clean Speech. In it contains information about a utility called File Hippo Updater that I think you will find extremly useful for keeping your programs up to date.

Sorry for spending your time and talents on what appears to be a security software bug and an odd set of coincidences that occurred simultaneously.

Please don't feel like you wasted any of my time. Because if you learned at least one thing from this experience then it was completly worth it! I truly enjoy getting to work with users like yourself. So please don't feel like you wasted my time, because you didn't.

======

Your logs appear to be clean, so if you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.



Time for some housekeeping
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK: ComboFix /Uninstall



NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Commands
    [ClearAllRestorePoints]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.


NEXT:



OTL Clean-Up

We Need to Clean Up our Mess
Our work on your machine has left considerable leftovers on your box. Let's clean those up real quick:
  • Reopen Posted Image on your desktop.
  • Click on Posted Image
  • You will be prompted to reboot your system. Please do so.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.


NEXT:



All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===



Below I have included a number of recommendations for how to protect your computer against malware infections.


Updated Anti-Virus Program
It's essential that you have an updated anti-virus program running on your computer. You don't want to run more than one as it can cause program conflicts, as well as false positives

You can view an excellent list of Free Security Software programs that has been compiled by GeekstoGo.


Avoid P2P Programs

Remember that no matter how clean the program you're using for peer-to-peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via p2p filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

If you have any of these programs installed then I highly suggest you uninstall them.

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.


Internet Browsers

Many of the users that I assist here on the forums, ask me which programs they can use to prevent themselves from getting infected again in the future. The best answer I can give you is too practice safe browsing.

Please consider using an alternative browser such as Google Chrome or Opera. They are both much more secure than Internet Explorer, immune to almost all known browser hijackers, and also have great built-in pop-up blockers.

I also suggest you make your Internet Explore more secure.


Make Internet Explorer more secure

  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.



Extra Goodies

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • You should run an updated scan with MalwareBytes' Anti-Malware weekly. Instructions are included below:

    • Open Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Check for Updates

  • Be weary of e-mails from unknown senders. Keep the following in mind as well: If it's to good to be true, then it more than likely is.

  • FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for Chrome and Opera.
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security--What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Cheers,
SweetTech.
  • 0

#19
Jeff_F

Jeff_F

    Member

  • Topic Starter
  • Member
  • PipPip
  • 27 posts
Hey SweetTech,

Deleted files, Ran OTL, then used clean up to remove it. Oddly enough, when I rebooted the desktop didn't run, I had to start it and my security software manually. Don't think this is malware related, just a system fluke.

***
========== COMMANDS ==========
Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.31.0 log created on 11042011_065158

***
Installed File Hippo - I had some other update checking programs but never used them. This was a useful experience and will likely keep me out of trouble in the future. I just hope I didn't take you away from your efforts to help others.

Thanks for your expertise and sound advice!

Jeff Ferreri
  • 0

#20
SweetTech

SweetTech

    Sir SpamAlot

  • Retired Staff
  • 7,671 posts
Hi Jeff!

It was my absolute pleasure being able to assist you.

Please take good care, and don't be a stranger around here at G2G.

Kindest Regards,
SweetTech.
  • 0

#21
SweetTech

SweetTech

    Sir SpamAlot

  • Retired Staff
  • 7,671 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP