[mary58]

I don't have the full version of malwarebytes so there was nothing to disable, however microsoft security essentials had become enabled again, so I disabled that. I'm not sure that OTL actually finished because it was not responding however when I restarted my computer the following text file came up in notepad.

Files\Folders moved on Reboot...
File\Folder C:\Users\Jim\AppData\Local\Temp\HPV335.tmp.vdf not found!
C:\Users\Jim\AppData\Local\Temp\HPVF567.tmp.vdf moved successfully.
File\Folder C:\Users\Jim\AppData\Local\Temp\HPVF578.tmp.vdf not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\HPVF672.tmp.vdf not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\~DF9DDB.tmp not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\~DF9DF0.tmp not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\~DF9E11.tmp not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\~DF9E2B.tmp not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\~DF9E4B.tmp not found!
File\Folder C:\Users\Jim\AppData\Local\Temp\~DF9E72.tmp not found!

PendingFileRenameOperations files...
File C:\Users\Jim\AppData\Local\Temp\HPV335.tmp.vdf not found!
File C:\Users\Jim\AppData\Local\Temp\HPVF567.tmp.vdf not found!
File C:\Users\Jim\AppData\Local\Temp\HPVF578.tmp.vdf not found!
File C:\Users\Jim\AppData\Local\Temp\HPVF672.tmp.vdf not found!
File C:\Users\Jim\AppData\Local\Temp\~DF9DDB.tmp not found!
File C:\Users\Jim\AppData\Local\Temp\~DF9DF0.tmp not found!
File C:\Users\Jim\AppData\Local\Temp\~DF9E11.tmp not found!
File C:\Users\Jim\AppData\Local\Temp\~DF9E2B.tmp not found!
File C:\Users\Jim\AppData\Local\Temp\~DF9E4B.tmp not found!
File C:\Users\Jim\AppData\Local\Temp\~DF9E72.tmp not found!

Registry entries deleted on Reboot...

[Advertisements]

Please tell me how the computer is running.

[CompCav]

Please tell me how the computer is running.

[mary58]

It seems to be running okay.

[CompCav]

Glad to here it is running OK. We have a few steps left!




Step 1.

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application. Please do not accept the trial right now. We just want to run it on demand.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Step 2.

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Vista / 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on:

If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the following instructions work with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow Add-On/Active X to install.
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Step 3.

Security Check
Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Step 4.

Please post:


mbam log
eset log
security check log

Please give me an update on how your computer is doing!

[mary58]

MalwareBytes log

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.29.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Jim :: JIM-PC [administrator]

8/2/2012 4:56:16 PM
mbam-log-2012-08-02 (16-56-16).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 242057
Time elapsed: 8 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[mary58]

here is the e set log

C:\FRST\Quarantine\services.exe Win32/Sirefef.FB.Gen trojan deleted - quarantined
C:\Users\Jim\Downloads\couponprinter.exe probably a variant of Win32/Adware.Softomate.AD application cleaned by deleting - quarantined

[CompCav]

Those logs are looking good.

Go ahead and post the security check log

[mary58]

Sorry for h delay, The site went down just as I was posting the log.

Here is the securitycheck log The computer seemed to be running okay while it was running these test.

Results of screen317's Security Check version 0.99.43
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
CCleaner
Java™ 6 Update 31
Java™ SE Runtime Environment 6
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 10.3.183.20 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (for.)
Google Chrome 20.0.1132.57
Google Chrome 21.0.1180.60
Google Chrome VisualElementsManifest.xml..
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0 %
````````````````````End of Log``````````````````````

[CompCav]

Re enable your antivirus realtime protection.

Step 1.

Clear the Java Cache by following the instructions here


Then you will need to reconnect to the internet. At this point update Norton virus definitions and update MalwareBytes' then go on to step 2.

Step 2.

Update Java

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.


Step 3.

Update Adobe Reader

Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.

Uninstall all previous versions.
Download the latest version from: http://www.adobe.com.../readstep2.html

If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.


Step 4.

Update adobe flash player

We need to uninstall the existing flash player(s). Please go here
Follow steps 1. to 4.
Once flash player is uninstalled go on to the next paragraph.

You will need to download and install both the IE and non-IE versions of Adobe Flashplayer. Make sure to uncheck the install of the McAfee tool before downloading. You will need to select your operating system (Windows Vista 32-bit) and then each version to download and install separately.


After these updates, are there any remaining issues?

[mary58]

I've reinstalled Java, haven't got to Adobe yet, I should get that done tomorrow. The computer has been working fine when we've used it.

[CompCav]

Thank you for the update and the good news on how it is running

I will be here.

Regards,

CompCav

[mary58]

I got Adobe all updated and the computer seems to be working fine.

[CompCav]

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Your log now appears clean

The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the Cleanup button. It will remove all the programs we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
• Right click Disc cleanup and select run as administrator
• Select Your main drive and accept the warning if you get one
• For a few moments the system will make some calculations
• Select the More Options tab
• In the System Restore and Shadow Backups select Clean up
• Select Delete on the pop up
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe

[CompCav]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.