should I remove the "NDP1.1sp1 kb2833941 -x86" from my desk top? How about "dotnetfx" application from C: ?
KB2833941 fails to install [Solved]
#16
Posted 04 December 2013 - 07:27 PM
should I remove the "NDP1.1sp1 kb2833941 -x86" from my desk top? How about "dotnetfx" application from C: ?
#17
Posted 04 December 2013 - 08:13 PM
That's great news. We will remove the security update and the dotnetfx.exe file when we clean up.OK!!! The install finally worked. After executing the command it immediately asked if I wanted to install Net Framework. I responded, "yes". After it completed, it asked to reboot, which I did. I then clicked on the update and it installed.
should I remove the "NDP1.1sp1 kb2833941 -x86" from my desk top? How about "dotnetfx" application from C: ?
Next we are gonna run an online scanner to look for any residual malware files and a scan to check for any programs that might need updating.
Please disable any screen saver you may have running before completing the following step.
Step-1.
Run ESET Online Scanner:
Note: Optimized for Internet Explorer but you can use Chrome or Mozilla FireFox for this scan.
Important! You will need to disable your currently installed Anti-Virus program, how to do so can be read here.
- Please go here then click on:
Note: If using Mozilla Firefox a window will open telling you that you will need to download the ESET Smart Installer. Click on esetsmartinstaller_enu.exe to download the Smart Installer. Save it to the desktop.
When prompted double click on the icon on the desktop. After successful installation of ESET Smart Installer ESET Online Scanner is launched in a new window.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox. - A new window will open:
- Select the option YES, I accept the Terms of Use then click on:
- When prompted allow the Add-On/Active X to install. The following window will open:
- Uncheck the box beside Remove Found Threats
- Check the box Scan archives.
- Now click on Advanced Settings and select the following:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
- Now click on:
- The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
- When completed the Online Scan will begin automatically. The scan may take several hours.
- Wait for the scan to finish. Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
A.
If No Threats Were Found:
- Put a checkmark in Uninstall application on close
- Close the program
- Report to me that nothing was found
If Threats Were Found:
- Click on list of threats found
- Click on export to text file and save it to the desktop as ESET SCAN.txt
- Click on Back
- Put a checkmark in Uninstall application on close Be sure you have saved the file first
- Click on Finish
- Close the program
Step-2.
Run Security Check
Download Security Check from here or here and save it to the Desktop.
- Double click the SecurityCheck icon to run the application.
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Step-3.
Things For Your Next Post:
Please post the logs in the order requested. Do Not attach the logs unless I request it.
1. The ESET scan log (IF it found anything). If it didn't just let me know.
2. The checkup.txt log
#18
Posted 05 December 2013 - 07:09 AM
C:\Documents and Settings\Fred\My Documents\hwmonitor_1.21-setup.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\_OTL\MovedFiles\12032013_171430\C_Documents and Settings\All Users\Application Data\{484395D8-1F9B-4C71-9DA9-A64CBD0E8DE2}\setup.res a variant of Win32/HiddenStart.A application
C:\_OTL\MovedFiles\12032013_171430\C_Documents and Settings\Dad\My Documents\Downloads\disk-defrag-setup.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\_OTL\MovedFiles\12032013_171430\D_Documents and Settings\All Users.WINDOWS\Desktop\eBay.url Win32/Adware.ADON application
C:\_OTL\MovedFiles\12032013_171430\D_Documents and Settings\All Users.WINDOWS\Start Menu\Programs\eBay.url Win32/Adware.ADON application
C:\_OTL\MovedFiles\12032013_171430\E_Fred\Local Settings\Temp\AskSLib.dll a variant of Win32/Bundled.Toolbar.Ask application
C:\_OTL\MovedFiles\12032013_171430\M_Fred's 1\Shawn\Dimesale_Personal.zip a variant of Generik.JEXCAHK trojan
C:\_OTL\MovedFiles\12032013_171430\M_Fred's 1\Shawn\DimeSale_Sales.zip a variant of Generik.JEXCAHK trojan
C:\_OTL\MovedFiles\12032013_171430\M_Marketing\Shawn\Dimesale_Personal.zip a variant of Generik.JEXCAHK trojan
C:\_OTL\MovedFiles\12032013_171430\M_Marketing\Shawn\DimeSale_Sales.zip a variant of Generik.JEXCAHK trojan
C:\_OTL\MovedFiles\12032013_171430\M_Vollara 10-12-12\pc-cleaner.exe multiple threats
E:\Fred\My Documents\hwmonitor_1.21-setup.exe a variant of Win32/Bundled.Toolbar.Ask application
M:\System Volume Information\_restore{985DA8BB-A73D-4FE4-8B93-AB0D724CAB9B}\RP1301\A0343224.exe multiple threats
Security Check results
Results of screen317's Security Check version 0.99.77
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
MVPS Hosts File
Java 7 Update 45
Adobe Flash Player 11.9.900.152
Adobe Reader 8
Adobe Reader XI
Mozilla Firefox (25.0.1)
````````Process Check: objlist.exe by Laurent````````
WinPatrol winpatrol.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
BillP Studios WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 11% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````
#19
Posted 05 December 2013 - 03:41 PM
Most of the files that ESET found had already been quarantined by OTL. I will include the others in an OTL fix during the clean up process.
OK! Well done. Here is the best part of the process! The mullygrubs are gone! That's a technical term for your log(s) appear to be clean! If you have no further issues with your computer, please complete the housekeeping procedures outlined below.
The first thing we need to do is to remove all the tools that we have used. This is so that should you ever be re-infected, you will download updated versions.
If you didn't uninstall ESET after running the program we will do it now.
Step-1.
Uninstall ESET
1. Please click Start > Control Panel > Add/Remove Programs
2. In the list of programs installed, locate the following program(s):
ESET
3. Click on each program to highlight it and click Change/Remove.
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.
Step-2.
Uninstall AdwCleaner
Re-open AdwCleaner
- Click the Uninstall button
- Confirm with yes
Step-3.
OTL Cleanup
1. Please copy all of the text in the Quote box below (Do Not copy the word Quote). To do this, highlight everything inside the Quote box (except the word Quote) , right click and click Copy.
:COMMANDS
[createrestorepoint]
:FILES
C:\Program Files\ESET
C:\dotnetfx.exe
C:\Documents and Settings\Fred\My Documents\hwmonitor_1.21-setup.exe
E:\Fred\My Documents\hwmonitor_1.21-setup.exe
M:\System Volume Information\_restore{985DA8BB-A73D-4FE4-8B93-AB0D724CAB9B}\RP1301\A0343224.exe
:COMMANDS
[EMPTYTEMP]- Please re-open on your desktop.
- Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
- Click the button.
- Let the program run unhindered. When finished click the OK button and close the log that appears.
- NOTE: I do not need to review the log produced.
- OTL may ask to reboot the machine. Please do so if asked.
- Be sure all other programs are closed as this step will require a reboot.
- Click on
- You will be prompted to reboot your system. Please do so.
Step-4.
Delete the following Files and Folders on the Desktop (If Present):
JRT.exe
JRT.txt
SecurityCheck.exe
checkup.txt
NDP1.1sp1-KB2833941-X86.exe
Delete any other .bat, .log, .reg, .txt, and any other files created during this process, and left on the desktop and empty the Recycle Bin.
Step-5.
Reset Hidden Files and Folders
1. Click Start.
2. Open My Computer.
4. Select the Tools menu and click Folder Options.
5. Select the View tab.
6. Under the Hidden files and folders heading UNSELECT Show hidden files and folders.
7. Click the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK.
Step-6.
Make a Fresh Restore Point, Clear the Old Restore Points, and Re-enable System Restore
The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected, but that's good news).
Note: Do not clear infected/old System Restore points before creating a new System Restore point first!- Click Start > All Programs > Accessories > System tools > System Restore. The System Restore Wizard opens.
- Note: If the System Restore Wizard does not open, the System Restore feature may be turned off. To turn System Restore on, follow these steps:
- Click Start, click Control Panel, and then double-click System.
- Click the System Restore tab.
- Make sure that the Turn off System Restore check box is not selected. Or, make sure that the Turn off System Restore on all drives check box is not selected.
- Click OK.
[*] Click NEXT
[*] Enter a name e.g. Clean
[*] Click CREATE
[*] Close System Restore[/list]Turn OFF System Restore.
- On the Desktop, right-click My Computer.
- Click Properties.
- Click the System Restore tab.
- Check Turn off System Restore.
- Click Apply, and then click OK.
Restart your computer.
- On the Desktop, right-click My Computer.
- Click Properties.
- Click the System Restore tab.
- UN-Check Turn off System Restore.
- Click Apply, and then click OK.
System Restore will now be active again.
Step-7.
Re-start WinPatrol
- Open the WinPatrol program.
- Click on the Options tab.
- You should see a check box at the bottom of the GUI that says, Automatically run WinPatrol when computer starts
- Click the box to put a check mark in it then re-start Windows
Step-8.
After you have finished with these clean up steps and read the prevention suggestions below, you should defragment the hard disk. If you need directions for that please click here to go to the Microsoft support page.
Preventing Re-Infection
Below, I have included a number of recommendations for how to protect your computer against future malware infections.
:Keep Windows Updated:-Windows Updates are constantly being revised to combat the newest hacks and threats. Microsoft releases security updates that help your computer from becoming vulnerable.
Please either enable Automatic Updates or get into the habit of checking Windows Update regularly. They usually have security updates every month. You can set Windows to notify you of Updates so that you can choose, but only do this if you believe you are able to understand which ones are needed. This is a crucial security measure.
XP Users: You must use Internet Explorer to Update Windows.
1. Click Start> All Programs, in the programs window that comes up, look for Windows Update toward the top of the list and click it.
:Turn On Automatic Updates:
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software or need it to play games on-line.
In that instance I would recommend that you only use Firefox or Chrome to visit those sites and do the following:
- For Firefox, install the NoScript add-on.
- For Chrome, install the Script-No add-on.
NOTE: After installing the add-ons you will need to tell them that the site you are visiting is allowed to run Java. - Disable Java in your browsers until you need it for that software and then enable it. (See How to disable Java in your web browser or How to unplug Java from the browser)
- Click the Start button
- Click Control Panel
- Double Click Java - Looks like a coffee cup. You may have to switch to Classical View on the upper left of the Control Panel to see it.
- Click the Update tab
- Click Update Now
- Allow any updates to be downloaded and installed
- Open Adobe Reader
- Click Help on the menu at the top
- Click Check for Updates
- Allow any updates to be downloaded and installed
NOTE: Many installers offer third-party downloads that are installed automatically when you do not uncheck certain checkboxes. While most of the time not being malicious you usually do not want these on your computer. Be careful during the installation process and you will avoid seeing tons of new unwanted toolbars in your favorite web browser.
:Web Browsers:
:Make your Internet Explorer more secure:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to "Prompt"
6. Change the Download unsigned ActiveX controls to "Disable"
7. Change the Initialise and script ActiveX controls not marked as safe to "Disable"
8. Change the Installation of desktop items to "Prompt"
9. Change the Launching programs and files in an IFRAME to "Prompt"
10. When all these settings have been made, click on the OK button.
11. If it prompts you as to whether or not you want to save the settings, click the Yes button.
12. Next press the Apply button and then the OK to exit the Internet Properties page.
This webpage is worth bookmarking/reading for future reference:
Securing Your Web Browser
:Alternate Browsers:
If you use Firefox, I highly recommend these add-ons to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
- WebOfTrust - a safe surfing tool for your browser. Traffic-light rating symbols show which websites you can trust when you search, shop and surf on the Web.
- McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
- MVPS Hosts file-replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
Preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running a full scan at least once a month. Run Quick Scans at least once a week. Download the Free versions. And update the definitions before running scans.
========Anti Spyware========
- Malwarebytes-Free Version- a powerful tool to search for and eliminate malware found on your computer.
- SUPERAntiSpyware Free Edition-another scanning tool to find and eliminate malware.
- SpywareBlaster-to help prevent spyware from installing in the first place. A tutorial can be found here.
- WinPatrol - will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. Help file and tutorial can be found here.
“CryptoLocker” is the generic name for an increasingly prevalent and nasty strain of malicious software that encrypts the files on your computer until you pay a ransom. Some variants encrypt you personal files(MP3s, photos, doc files,ect;). But ither variants encrypy virtually every file, including system files. According to reports from security firms, CryptoLocker is most often spread through booby-trapped email attachments, but the malware also can be deployed by hacked and malicious Web sites by exploiting outdated browser plugins.
Unfortunately, there isn't a way to recover the files short of paying the ransom because the encryption uses 2048-bit RSA keys that would take like a quadrillion years to decrypt.
We haven't seen a lot of the CryptoLocker ransomeware in the wild yet, but if enough people pay the ransom to get their files back it will become more prevelant. You can read more about the CryptoLocker ransomware here
Fortunately there is a program that will help prevent this type of ransomeware and other malware. You should download it and install it now.
Click here to go to the CryptoPrevent web page. You can read about the program. There are also a couple of videos toward the end of the page that show the program in action.
Scroll to the bottom of the page and click the Download "CryptoPrevent Installer" button and download the file to the desktop. Close the browser and all open programs.
Double click the CryptoPreventSetup.exe file to install it.
Next, Double click the CryptoPrevent icon on the desktop to run the program.
When the program opens make sure all boxes are checked and then click the Block button to apply the protection.
NOTE: I don't think the free version has an update tab so you will need to check the web site from time to time to check for newer versions of the program. Or you can pay a one time fee of $15 and get the Premium Edition which includes an automatic updating function.
It's a good idea to clear out all your temp files every now and again. This will help your computer from bogging down and slowing. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.
========TEMP File Cleaners========
- TFC by OldTimer-A very powerful cleaning program for 32 and 64 bit OS. Note: You may have this already as part of the fixes you have run.
- CleanUP-Click the Download CleanUP! link. There is also a Learn how to use CleanUP! link on this page.
- Keep a backup of your important files.-Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
- ERUNT-(Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.
A program that will do this is listed below. Download and install the program and run it monthly:
Filehippo Update Checker
Finally, please read How did I get infected in the first place? by Mr. Tony Cline
I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.
IF I have helped you and you want to say "thanks", you can do that by clicking the Rep+ button at the bottom right of this post.
I Will Keep This Open For 24 hours or so. If Anything Comes Up - Just Come Back And Let Me Know
Stay Safe
godawgs
#20
Posted 05 December 2013 - 07:11 PM
Fred
Edited by Fred60, 05 December 2013 - 08:33 PM.
#21
Posted 06 December 2013 - 09:44 AM
I think those programs are like the old snake oil salesmen who claimed their magic elixir would cure everything that ailed you....and then you died!
Stay safe on the internet and if you need us in the future just give us a shout.
godawgs
#22
Posted 07 December 2013 - 07:59 AM
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users