[JSntgRvr]

Download the enclosed file.

Save it in the location FRST is.

Run FRST and click on the Fix button. Wait until finished.

The tool will make a log in the flashdrive (Fixlog.txt) please post it to your reply.

Attempt a quick scan with mbam after a restart. Let me know the outcome.

[Advertisements]

Did as you said, after restart ran malwarebytes to the same result. Scans to additional items then hangs.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-01-2014
Ran by Geric at 2014-01-05 21:21:08 Run:3
Running from C:\Users\Geric\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
AlternateDataStreams: C:\Users\Geric\Cookies:NPvv03KOXbzv0SRn73sfpQH7
End
*****************

AppMgmt => Service deleted successfully.
"C:\Users\Geric\Cookies" => ":NPvv03KOXbzv0SRn73sfpQH7" ADS not found.

==== End of Fixlog ====

[geric16]

Did as you said, after restart ran malwarebytes to the same result. Scans to additional items then hangs.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-01-2014
Ran by Geric at 2014-01-05 21:21:08 Run:3
Running from C:\Users\Geric\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
AlternateDataStreams: C:\Users\Geric\Cookies:NPvv03KOXbzv0SRn73sfpQH7
End
*****************

AppMgmt => Service deleted successfully.
"C:\Users\Geric\Cookies" => ":NPvv03KOXbzv0SRn73sfpQH7" ADS not found.

==== End of Fixlog ====

[JSntgRvr]

Please run a free online scan with the ESET Online Scanner

Vista / Win7 users: Right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator.

Note: This scan works with Internet Explorer or Mozilla FireFox.

If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

• Click the green ESET Online Scanner box
• Tick the box next to YES, I accept the Terms of Use
  then click on: Start
• You may see a panel towards the top of the screen telling you the website wants to install an addon... click and allow it to install. If your firewall asks whether you want to allow installation, say yes.
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close, make sure you copy the logfile first!
• Then click on: Finish
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

[geric16]

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=20bebf57df11d9488e474045c1c926a0
# engine=16541
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-01-06 10:58:20
# local_time=2014-01-06 05:58:20 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 77 785216 871781 0 0
# compatibility_mode=5893 16776573 100 94 0 140592550 0 0
# scanned=190387
# found=0
# cleaned=0
# scan_time=8127

[JSntgRvr]

There is no known malware in your system. I can't explain why MBAM hangs on your computer, but as far as malware you are ready to go. If MBAM is the only scanner hanging, then I would suggest you download a similar scanner and protection instead.

Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools.

If you downloaded Combofix, the following will implement some cleanup procedures as well as reset System Restore points:

• Press the Windows key + R. At the Run command type or copy and paste the following:
  
  

  Combofix /uninstall

Run OTL. Click on the Cleanup button and follow the prompts.

Run AdwCleaner and uninstall

Manually remove any tool left.

Here are some suggestions.

• Always keep your JAVA updated. Older versions will make your computer vulnerable.
  
• Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Miekiemoes.

Best wishes!

I will keep the topic opened for a few days should you need further help.

[JSntgRvr]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.