Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Infected with lots of malware [Solved]


  • This topic is locked This topic is locked

#16
infected24

infected24

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

Hi - Sorry I forgot to mention in my pevious post that the computer is running fine now.  My hotmail seems to be working fine too.  But I also want to double check with my grandfather. He will be coming home soon so I will put up another post shortly explaining.  Thank you very much for all of your help!

 

I did notice however, when I go into "sign in" on this website to put a post, the computer freezes for about 10-15seconds and the toolbar above changes to "not responding".  However after 10-15seconds, the problem clears away on its own and I am able to sign in just fine to put up a post.

 

Thank you 


  • 0

Advertisements


#17
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

I did notice however, when I go into "sign in" on this website to put a post, the computer freezes for about 10-15seconds and the toolbar above changes to "not responding".

 

You have such little free space on your hard drive that it wouldn't surprise me to have some performance issues like this.

 

You currently are on version 8 of Internet Explorer. Version 11 is out for Windows 7. Even if you don't use IE as your default browser it's imperative to keep it updated to protect yourself from exploits. Please do the following.

 

Step#1 - Upgrade to IE 11

1. Please download and install IE11 from here.

 

Step#2 - Keeping Java Updated
If you don't use Java or don't know if you need it I would simply skip this step. If you do use it then feel free to follow the instructions to get current.

 

WARNING: Java is one of the most exploited programs at this time. The Department of Homeland Security recommends that computer users disable Java. You can read more about this here.
I would recommend that you completely uninstall Java unless you need it to run an important software. If you need it or are unsure or uncomfortable with removing it then I would recommend that you disable Java in your browsers until you need it and then enable it at that time. (See How to disable Java in your web browser and How to unplug Java from the browser). If you don't uninstall it, it's also important that you follow the directions below to update to the latest version of Java.
 
1. Go to this page to download the latest version of Java SE Runtime Environment JRE 8 Update 31.
2. When you click this link you will need to click the "Accept License Agreement" radio button and then click on the "Windows x86 Offline" installer link. You will notice that there is also a Windows x64 link option, however even if you are using a 64-bit operating system, it's very likely you aren't running a 64-bit browser and should only download the "Windows x86 Offline" installer. To determine if you are using a 64-bit browser you can follow these instructions. If you find that you ARE using a 64-bit browser then you can download the "Windows x64" one.
8u31.JPG

3. Once you click on the appropriate link, please download this to your Desktop like we have with all of our tools.
4. Close any programs you may have running - especially your web browser.
5. Now we need to uninstall all versions of Java that are currently on your machine before we install the newest version. Go to Add/Remove programs (instructions are here) and uninstall any item that appears in the list that has the following as part of the name: Java 7 Update 25 (you already uninstalled this)
6. Reboot your computer once all Java components are removed.
7. Then from your desktop, right click on the file that was downloaded (jre-8u31-windows-i586.exe or jre-8u31-windows-x64.exe) and select Run as an Administrator to install the latest version. Accept all the defaults and you're good to go.
Note: Java has been notorious for installing foistware (software downloaded without the users knowledge). If you follow the instructions I provided no foistware will be installed but that doesn't mean it won't in the future. While performing the install of this software or any software for that matter, pay attention to each screen and ensure you uncheck any extra software that you don't want installed (i.e. Ask Toolbar, Chrome Browser, etc.).


  • 0

#18
infected24

infected24

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

Hello - As per your email, I have installed the latest version of Internet Explorer.  We do not use Java, so I have skipped Step #2 as per your instructions.

 

I also spoke with my grandfather, he said it took him a long time to sign-out of Hotmail today.  Other than that, it was completely normal.  I understand that this may be caused by the lack of space available on the hard drive.  We have a lot of pictures on this computer which I will put on an external drive soon to free up some space. 

 

Please kindly let me know if there are any other steps you would like me to complete.  I again cannot thank you enough for all of your help. 


  • 0

#19
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

No problem. OK! Well done, your computer is clean again! :thumbsup: Part of our jobs here at G2G is to help you clean your computer. But beyond that and just as important is to provide you with some information to keep you safe and secure on the net as well as to share knowledge. Following is that information.
 
 
1. Clean Up!
We need to remove all the tools that we used so that should you ever be re-infected, you will download updated versions which may have updated detection logic.
1. Download Delfix from here.
2. Ensure everything is checked.
3. Click Run.
Note: The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.
Note: Delete any  other .bat, .log, .reg, .txt,  and any other files created during this process, and left on the desktop and empty the Recycle Bin.
 
2. Windows Updates
Another essential task is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats. Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically. Follow the instructions below to ensure your settings are optimal.
1. Click the Start Orb in the lower left corner of the screen.
2. Type Windows Update in the search box that appears
3. Click on the Windows Update program that appears in the search results.
Windows%20Update.JPG
4. Click on Change Settings.
CheckForUpdates.JPG
5. Select "Install updates automatically (recommended)" from the Important updates drop-down.
WUChangeSettings.JPG
6. Choose a day and a time when you know the computer will be on and connected to the internet. The default is 3:00AM every day.
7. Ensure that all of the other check boxes are checked.
8. Click OK.
 
3. Keeping Programs Updated
You need to ensure that any programs installed on your machine are kept current. The bad guys exploit vulnerabilities that are found in older versions of software. A very good piece of software that keeps your programs up-to-date is Secunia Personal Software Inspector (PSI). You can download and install it from here. You can read more information about this free software as well as a video walkthrough from here.
 
  
4. Antimalware- Preventative

Note: Let's keep Malwarebytes installed as it's a fantastic piece of software. Malwarebytes is an anti-malware software and not an antivirus software so it won't conflict with the Antivirus that you are running. I would recommend that you open up this program, allow it to update and scan your machine at least quarterly...monthly if you can.
 
5. Crypto Warning!!!! - Complete Data Loss can occur!
There are particularly nasty infections out there at the moment that encrypt your data and hold it for ransom. You may read more about this here.
New strains of this are coming out all the time. In fact a very new strain called VirRansom (which is a hybrid of CrytoLocker and CryptoWall) has recently been identified and it's a true self-replicating parasitic virus.

 

  • Download CryptoPrevent free for home use here following the instructions below.
  • Save the file to your desktop from the link above and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
  • Accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This is good and will launch the program once you click Finish.
  • You will get a prompt asking if you purchased a Product Key for Automatic Updates. You can answer No.
  • You will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to.
  • You will then be prompted to apply all default protections. Answer Yes.
  • You may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.
  • That's it. The protection is in place.

Note: The free version doesn't provide automatic updates. Periodically, you should open up the program (there is a shortcut on your desktop now) and select the Updates! menu....and select Check for Updates to see if there are any as this infection has serious consequences.
 
Updates.JPG
 
 
 
For more information about computer security and how to protect yourself when on the internet, please read this guide Best Practices for Safe Computing
 
OK, all the best, and stay safe!

Items for your next post
1. Contents of the delfix log


  • 0

#20
infected24

infected24

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

Thank you! My computer is now clean all thanks to G2G!! Below is the log you have requested along with a few questions I have regarding the previous post as I am just unsure of a few things.

 

1.  Contents of the delfix log:

 

# DelFix v10.8 - Logfile created 23/01/2015 at 00:17:53
# Updated 29/07/2014 by Xplode
# Username : owner - GSGILL
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\_OTL
Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\owner\Desktop\Addition.txt
Deleted : C:\Users\owner\Desktop\AdwCleaner.exe
Deleted : C:\Users\owner\Desktop\aswMBR.exe
Deleted : C:\Users\owner\Desktop\aswMBR.txt
Deleted : C:\Users\owner\Desktop\Fixlog.txt
Deleted : C:\Users\owner\Desktop\FRST step 5.txt
Deleted : C:\Users\owner\Desktop\FRST.txt
Deleted : C:\Users\owner\Desktop\FRST64.exe
Deleted : C:\Users\owner\Desktop\JRT.exe
Deleted : C:\Users\owner\Desktop\JRT.txt
Deleted : C:\Users\owner\Desktop\MBR.dat
Deleted : C:\Users\owner\Desktop\Search.txt
Deleted : C:\Users\owner\Desktop\SecurityCheck.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #237 [Windows Modules Installer | 01/22/2015 22:56:04]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

 

2. Windows Update - DONE

 

3. Keeping Programs updated - I installed Secunia from the link provided.  Secunia prompted me that I have 7 programs that need updating: Adobe Reader 7; Google Chrome 39; Microsoft Internet Explorer 11.x(64bit); Microsoft Internet Explorer 11.x; Microsoft XML Core Services (MSXML) 4.x; and WinRAR 4.x.  But I thought I had just installed the latest version of Internet Explorer today from the link provided in a previous post.  Any idea why then Secunia is asking me to update again?

 

4. Antimalware - Will run this monthly. Thank you for letting me know.

 

5. I downloaded CryptoPrevent.  I saved the file on my desktop and clicked on Run as instructed.  I followed the steps provided however I noticed that the "printscreen" you provided in your post did not exactly match the screen I saw on my computer.  My screen had the following default option: "Default - Set it and forget it protection" NOT "Default - Recommended for most people" as seen in the printscreen provided by you.  Is this normal?  I did not click on "apply" because I wanted to run it by you first. Can you please let me know?   

 

Thank you!


  • 0

#21
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

3. Keeping Programs updated - I installed Secunia from the link provided.  Secunia prompted me that I have 7 programs that need updating: Adobe Reader 7; Google Chrome 39; Microsoft Internet Explorer 11.x(64bit); Microsoft Internet Explorer 11.x; Microsoft XML Core Services (MSXML) 4.x; and WinRAR 4.x.  But I thought I had just installed the latest version of Internet Explorer today from the link provided in a previous post.  Any idea why then Secunia is asking me to update again?

 

That's a great question. I use this software on my machines and haven't encountered this before. I'm surprised it's saying Adobe Reader 7 as well?? The only thing I can suggest if you want to figure that out is to maybe post an inquiry on their site and see if you get an answer. http://secunia.com/c...nity/forum/psi/

 

5. I downloaded CryptoPrevent.  I saved the file on my desktop and clicked on Run as instructed.  I followed the steps provided however I noticed that the "printscreen" you provided in your post did not exactly match the screen I saw on my computer.  My screen had the following default option: "Default - Set it and forget it protection" NOT "Default - Recommended for most people" as seen in the printscreen provided by you.  Is this normal?  I did not click on "apply" because I wanted to run it by you first. Can you please let me know?   

 

Thank you for pointing that out. They came out with a new version and the default is indeed different. I've updated my instructions as a result so thanks. Go ahead and apply.

 

Anything else I can assist you with?


  • 0

#22
infected24

infected24

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts

Hello,

 

Thank you for your reply.  Ok I will put up a post on Secunia.  I have also applied CrytoPrevent settings as per your instructions.

 

No I think that would be all :) 

 

I just wanted to take time and really thank you and G2G for all of your help and hard work in fixing my computer.  You guys are doing a great job helping others with computer problems.  If it wasn't for you guys, my computer would still be filled with viruses right now.  Your step by step and detailed instructions helped me clean my computer in no time.   I appreciate all the help you have provided.   Keep up the great work!! Thank you sooooooooo much!!!! :)


  • 0

#23
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

No problem. That was very kind!


  • 0

#24
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP