[Valinorum]

Okay with me.

[Advertisements]

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.06.05.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17107
Administrator :: HAMMER_PC [administrator]

6/11/2014 3:10:56 PM
mbam-log-2014-06-11 (15-10-56).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 447981
Time elapsed: 1 hour(s), 3 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 

[hammer55]

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.06.05.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17107
Administrator :: HAMMER_PC [administrator]

6/11/2014 3:10:56 PM
mbam-log-2014-06-11 (15-10-56).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 447981
Time elapsed: 1 hour(s), 3 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 

[Valinorum]

Post the ESET log when done.

[hammer55]

malware log - once is enough

 

my bad

Edited by hammer55, 11 June 2014 - 05:21 AM.

[hammer55]

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=635988bcc87e9e42a2a9c802fd5e7afb
# engine=18663
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-11 10:00:18
# local_time=2014-06-11 05:00:18 (+0700, SE Asia Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 0 166897708 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 154110668 0 0
# scanned=77515
# found=1
# cleaned=0
# scan_time=1645
sh=4570DA4D1FE4C73CD7C7B03ACF251D6A1D12FCE6 ft=0 fh=0000000000000000 vn="a variant of Win32/DorgeCapturer.A potentially unsafe application" ac=I fn="C:\Program Files\EOCP Drivers 0.9.311007.msi"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=635988bcc87e9e42a2a9c802fd5e7afb
# engine=18663
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-11 11:06:58
# local_time=2014-06-11 06:06:58 (+0700, SE Asia Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 0 166901708 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 154114668 0 0
# scanned=162529
# found=6
# cleaned=0
# scan_time=3643
sh=4570DA4D1FE4C73CD7C7B03ACF251D6A1D12FCE6 ft=0 fh=0000000000000000 vn="a variant of Win32/DorgeCapturer.A potentially unsafe application" ac=I fn="C:\Program Files\EOCP Drivers 0.9.311007.msi"
sh=2A88FC6509FDC3B22587F6E97AC12F70E4F75DC8 ft=1 fh=86e0df17c19558fd vn="a variant of Win32/Bundled.Toolbar.Ask.E potentially unsafe application" ac=I fn="C:\Users\Administrator\Documents\APNSetup1.exe"
sh=73C98F1721958026BEB496BFCF15FB9A28B3B7A0 ft=1 fh=9a28cb911a364095 vn="Win32/DownWare.L potentially unwanted application" ac=I fn="C:\Users\Administrator\Downloads\Unlocker1.9.2.exe"
sh=4570DA4D1FE4C73CD7C7B03ACF251D6A1D12FCE6 ft=0 fh=0000000000000000 vn="a variant of Win32/DorgeCapturer.A potentially unsafe application" ac=I fn="C:\Windows\Downloaded Installations\{A4B6892D-191F-49B5-8C9E-91A998E62E0D}\EOCP Drivers 0.9.311007.msi"
sh=9FFE733FFA9E48BDE9F2D399822DA9FE5284CF55 ft=1 fh=6e56d9f8aef3b200 vn="a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application" ac=I fn="C:\Windows\Installer\MSI29F5.tmp"
sh=FF0D89970794864D1E1919BB6971775E5A3DB993 ft=1 fh=5b4909f6df4b3dab vn="a variant of MSIL/Injector.BZU trojan" ac=I fn="H:\Eye Movie\My Little Pony - Friendship is Magic\MLP Games Super Pack\SWF Player.exe"
 

[Valinorum]

Hi hammer55,

• Step #6 Fix with OTL
  • Re-run OTL by right clicking and choosing Run as administrator;
  • Under the Custom Scans/Fixes Box copy and paste the following contents inside the quote box. (Do not include the word 'quote').
    

    :Commands
    [createrestorepoint]
    
    :Files
    C:\Program Files\EOCP Drivers 0.9.311007.msi
    C:\Users\Administrator\Documents\APNSetup1.exe
    C:\Users\Administrator\Downloads\Unlocker1.9.2.exe
    C:\Windows\Downloaded Installations\{A4B6892D-191F-49B5-8C9E-91A998E62E0D}\EOCP Drivers 0.9.311007.msi
    C:\Windows\Installer\MSI29F5.tmp
    H:\Eye Movie\My Little Pony - Friendship is Magic\MLP Games Super Pack\SWF Player.exe
    
    :Commands
    [emptytemp]

  • Click on "Run Fix" and let the program run unhindered;
  • Your PC will reboot automatically and a log will be opened;
  • Please post it in your next reply.

 

• Required Log(s):
  • OTL Fix Log

Regards,
Valinorum

[hammer55]

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
C:\Program Files\EOCP Drivers 0.9.311007.msi moved successfully.
C:\Users\Administrator\Documents\APNSetup1.exe moved successfully.
C:\Users\Administrator\Downloads\Unlocker1.9.2.exe moved successfully.
C:\Windows\Downloaded Installations\{A4B6892D-191F-49B5-8C9E-91A998E62E0D}\EOCP Drivers 0.9.311007.msi moved successfully.
C:\Windows\Installer\MSI29F5.tmp moved successfully.
File\Folder H:\Eye Movie\My Little Pony - Friendship is Magic\MLP Games Super Pack\SWF Player.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: ADMIN
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrator
->Temp folder emptied: 8350741 bytes
->Temporary Internet Files folder emptied: 3018015 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 87704915 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 830 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 290739 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 95.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 06122014_114319

Files\Folders moved on Reboot...
C:\Users\Administrator\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\_avast_\AvastLock.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
 

[hammer55]

File\Folder H:\Eye Movie\My Little Pony - Friendship is Magic\MLP Games Super Pack\SWF Player.exe not found.

 

I removed yesterday

[hammer55]

thanks for your time

[Valinorum]

File\Folder H:\Eye Movie\My Little Pony - Friendship is Magic\MLP Games Super Pack\SWF Player.exe not found.
 
I removed yesterday

Awesome.
How is your system running?

[hammer55]

its the bees knees

 

thanks

[Valinorum]

Perusing your logs, I see no infection currently present in your system. Unless you are having any issue(s), the machine appears to be Malware-free as we speak.

 
 

♣ Removal of Tools and Quarantined Files ♣

 

Despite the tools we have used are clean, they are powerful removal tools and made in a way so that they carry out any commands given to them without (most cases) asking for a confirmation. In the hands of an inept person, they can make the machine un-bootable -- a scenario we do not wish to see. Also, we need to remove the quarantined files/folders from your system as a dormant malware can be as bad as an active one if given the proper environment. I shall now give you the guidelines to remove the tools and the quarantined files from your system.

• Cleanup with Delfix
  Please download DelFix by Xplode to your Desktop.
  Download Link
  • Double-click to run the program;
    • Note: Windows Vista/7/8 users right-click and choose Run as administrator
  • Make sure that all the boxes are checked;
  • Click Run;
  • A log will be opened after the operation is finished;
  • Copy and Paste it in your next reply

 
 

♣ Prevention and Future Guidelines ♣

 

Prevention is better than cure -- goes the old saying. As much as we love to see you visit our site, we do not want to see you having your PC infected by malwares again.

• Keep Windows up-to-date.
  It is extremely important that you keep your operating system (Windows) updated when updates are made available. It is set to alert you, so be sure not to ignore these notices and to allow the updates to install. Many of these are critical security packages which could very possibly be the difference between your picking up a future infiltration and simply passing right by it unharmed.
• Run antivirus software and keep it up-to-date, too.
  Antivirus software is your safety net if all other protections fail. The first line of defense is smart computing, of course, but everyone needs a backup. I'd recommend Microsoft Security Essentials or avast!, both of which are excellent, as well as free. Once they're installed, check periodically to ensure they have been successfully updating as well. An out-of-date antivirus is not a happy antivirus!
• Keep your web browser plugins and other programs updated also.
  This tip is rarely shared by technicians and its importance is not widely recognized, but it's absolutely critical. Programs such as Java, Adobe Flash Player and Adobe Reader, Internet Explorer, and myriad other such web-exposed items are deeply vulnerable to attack, which can quickly lead to a hopelessly infected system no matter what protection you currently have installed. The reason is that these programs are ubiquitous, but are also not perfect and are extremely complex... and as such, security vulnerabilities are discovered and exploited by hackers hoping to gain control over your machine. By performing every update for these programs as soon as it's made available, you will greatly reduce your exposure to dangerous internet threats.
  
  A great way to do this is to install the Filehippo Update Checker and run it regularly. Also, try not to ignore any notifications you receive regarding updates to programs already installed on your PC.
  
  No scripts is an excellent security device too. I like it but it is not for everyone because it requires you to take action if you want to see some things (pop ups, banners etc.) on sites you visit.
  
  Download NoSript by Giorgio Maone.
  
  Note: Sometimes you will get a site telling you that you need to install Java when actually all you need to do is enable the site through the no script icon down on the right hand side of your computer.
• Watch out for new threat named CryptoLocker
  CryptoLocker is a new type ransomware family malware that encrypts your important files and asks for a ransom to decrypt them. At the moment of posting this reply there are no tools that can undo the havoc this malware causes. We can help you to remove the malware from your system but the files that was encrypted cannot be recovered without the decryption key. So, I ask for your forbearance and practice constant vigilance. Please read the following article to acknowledge yourself about the safety measures.
  How to prevent your computer from becoming infected by CryptoLocker.
• And last of all, surf smart.
  It doesn't matter how well the autopilot system works if the pilot keeps flying the plane into mountain ranges. Don't forget that no matter how much you have protecting yourself, your security ultimately begins and ends with you. Don't visit dangerous or questionable web sites, avoid suspicious links on Facebook and emails/email attachments you're unsure about, and just generally keep your wits about you, and you'll be much safer. Also, avoid illegal downloads, cracks, "warez", and all other too-good-to-be-true internet offerings: they're typically laden with malware. Be smart and you can avoid most threats lurking about the darker corners of the internet! And for even more tips, see our article, How Did I Get Infected in the First Place?
  
  

Regards,
Valinorum

[Valinorum]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.