Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Malware on Windows 7 PC [Solved]


  • This topic is locked This topic is locked

#16
scewter

scewter

    Member

  • Topic Starter
  • Member
  • PipPip
  • 96 posts

Completed as instructed. Here's the log after running the fix. I follow up with another post regarding the system restore issue

 

Fix result of Farbar Recovery Scan Tool (x64) Version:07-01-2015
Ran by Scott (2016-01-09 16:28:42) Run:2
Running from Y:\Scotty\Desktop
Loaded Profiles: Scott & Guest (Available Profiles: Scott & Guest)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
Y:\Downloads\BitZipper502TrialSetup-en-pl-techpro.exe
Y:\Downloads\powersuite_1[1].5-nara.rar
Y:\Scotty\Desktop\cbsidlm-tr1_13-CrystalDiskInfo-SEO-10832082.exe
Y:\Scotty\Downloads\CrystalDiskInfo5_6_2-en.exe
HKU\S-1-5-21-667926241-938725764-3588881007-1000\...\MountPoints2: I - I:\LaunchU3.exe -a
HKU\S-1-5-21-667926241-938725764-3588881007-1000\...\MountPoints2: {e22af264-b573-11e5-aace-8ce43ac2189d} - I:\LaunchU3.exe -a
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-667926241-938725764-3588881007-501 -> DefaultScope {49606DC7-976D-4030-A74E-9FB5C842FA68} URL =
Toolbar: HKU\S-1-5-21-667926241-938725764-3588881007-501 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
EmptyTemp:

*****************

Restore point was successfully created.
Y:\Downloads\BitZipper502TrialSetup-en-pl-techpro.exe => moved successfully
Y:\Downloads\powersuite_1[1].5-nara.rar => moved successfully
Y:\Scotty\Desktop\cbsidlm-tr1_13-CrystalDiskInfo-SEO-10832082.exe => moved successfully
Y:\Scotty\Downloads\CrystalDiskInfo5_6_2-en.exe => moved successfully
"HKU\S-1-5-21-667926241-938725764-3588881007-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I" => key removed successfully
"HKU\S-1-5-21-667926241-938725764-3588881007-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e22af264-b573-11e5-aace-8ce43ac2189d}" => key removed successfully
HKCR\CLSID\{e22af264-b573-11e5-aace-8ce43ac2189d} => key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKU\S-1-5-21-667926241-938725764-3588881007-501\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-21-667926241-938725764-3588881007-501\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => value removed successfully
HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => key not found.

=========  bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

=========  netsh advfirewall reset =========

Ok.

========= End of CMD: =========

=========  netsh advfirewall set allprofiles state on =========

Ok.

========= End of CMD: =========

EmptyTemp: => 39 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 16:28:53 ====


  • 0

Advertisements


#17
scewter

scewter

    Member

  • Topic Starter
  • Member
  • PipPip
  • 96 posts

Bruce1270,

 

 

Your system restore is turned off. Are you aware of this or turned it off yourself? I would strongly recommend this is turned on. It can be useful to restore to an earlier point where there are issues with the machine.
 

 

A few years ago I installed a 128gb ssd on this pc and loaded the OS as well as all the other programs on it while using the other HDD for my data storage. On account of the relatively small size of the ssd I looked hard at whether I wanted to have the System Restore eat up precious space on that drive or rely on another approach to create a similar solution. I chose the following - leave System Restore turned off but periodically make full backup images of the ssd and save them on an external hdd that is only used for that purpose.

 

I'm certainly open to suggestions about the wisdom of this approach, but since you raised the question I wanted to let you know the "what for".


  • 0

#18
Bruce1270

Bruce1270

    Trusted Helper

  • Malware Removal
  • 1,603 posts
Hi Scewter


Thanks for the explanation on the system restore. As long as you are aware of it. The recovery/backup strategy you have in place is fine and if works for you we won't change it. :)

Good stuff. All looks good. :)

So subject to no further problems...

Good News! - Your system now appears to be clean. :)
Now for some clean up and "housekeeping" procedures.

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
  • Download Delfix from here
  • Locate the file and right click on it. Click on Run as Administrator.
  • Ensure Remove disinfection tools is ticked
    Also tick:
  • Create registry backup
  • Purge system restore
  • Reset system settings

    delfix.jpg
  • Click Run

    The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply


    Care and maintenance

    Another essential task is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats. Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically. Follow the instructions below to ensure your settings are optimal.
    1. Click the Start Orb in the lower left corner of the screen.
    2. Type Windows Update in the search box that appears
    3. Click on the Windows Update program that appears in the search results.
    Windows%20Update.JPG
    4. Click on Change Settings.
    CheckForUpdates.JPG
    5. Select "Install updates automatically (recommended)" from the Important updates drop-down.
    WUChangeSettings.JPG
    6. Choose a day and a time when you know the computer will be on and connected to the internet. The default is 3:00AM every day.
    7. Ensure that all of the other check boxes are checked.
    8. Click OK.


    Malwarebytes - Update and run weekly to keep your system clean.


    Prevention programs

    Crypto Warning!!!! - Complete Data Loss can occur!

    There are particularly nasty infections out there at the moment that encrypt your data and hold it for ransom. You may read more about this here
  • Download CryptoPrevent free for home use here following the instructions below.
  • Save the file to your desktop from the link above and then open the program by clicking Run when prompted from your browser or by going to the desktop where the file was saved and double-clicking.
  • Accept all the defaults during the install. The last screen of the install has a checkmark in "Launch CryptoPrevent". This is good and will launch the program once you click Finish.
  • You will get a prompt asking if you purchased a Product Key for Automatic Updates. You can answer No.
  • You will then be prompted to learn more about automatic updates or if you want to purchase a key. This is up to you but you don't have to.
  • You will be prompted to click OK to continue and select your protection level. Go ahead and click OK.
  • Click the Apply button to set Default protection.
  • You may get a message stating that Windows Sidebar and Desktop Gadgets are a major security vulnerability and asking you if you want to disable them. If you don't use these features, answer Yes.
    That's it. The protection is in place.

    Note: The free version doesn't provide automatic updates. Periodically, you should open up the program (there is a shortcut on your desktop now) and select the Updates! menu....and select Check for Updates to see if there are any as this infection has serious consequences.
    UpdatesV7.4.11.JPG

    Unchecky

    Unchecky is a small service that runs in the background to help keep those "extra toolbars" and tag along search engines from automatically installing. By automatically directing you to a custom install with all the options unchecked, only what you manually choose and confirm gets installed.
  • Download Unchecky to your desktop
  • Right click on the Unchecky_setup and choose to Run as Administrator
  • Once open click the Install button.
  • Then click on Finish
  • Unchecky is now installed and will help you keep unwanted check boxes unchecked


    Some tips and advice to stay safe
  • Watch what you open in your emails. If you get an email from an unknown source with any attached files, do not open it.
  • Install and keep only one anti-virus on your machine. Update it and scan your machine with it at least once a week.
  • Be careful of the websites you visit.
  • When browsing the internet, look closely at the links you click on. Some aren't always what they seem.
  • Avoid Peer to Peer file sharing utilities, these are a minefield of malware infections.
  • Pay attention when installing a program to your computer, particularly to any check boxes that may appear during installation, it is common for unwanted software to be installed in this way.

    To learn more about how to protect yourself while on the internet read this little guide Best security practices.

    Go here for some good advice about how to prevent infection.

    That's us finished the cleaning process. It's been a pleasure working with you and thanks for staying with the topic.

    Happy safe surfing!! :)

    Don't forget to post your Delfix log!

  • 0

#19
scewter

scewter

    Member

  • Topic Starter
  • Member
  • PipPip
  • 96 posts

Here's the delfix log:

 

# DelFix v1.011 - Logfile created 10/01/2016 at 22:04:04
# Updated 18/08/2015 by Xplode
# Username : Scott - SCOTT-PC
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : Y:\Scotty\Desktop\Addition.txt
Deleted : Y:\Scotty\Desktop\AdwCleaner.exe
Deleted : Y:\Scotty\Desktop\Fixlog.txt
Deleted : Y:\Scotty\Desktop\FRST.txt
Deleted : Y:\Scotty\Desktop\FRST64.exe
Deleted : HKLM\SOFTWARE\AdwCleaner

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #110 [Restore Point Created by FRST | 01/09/2016 21:28:42]
Deleted : RP #111 [Windows Update | 01/10/2016 06:41:06]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########


  • 0

#20
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP