Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Computer Infected [Solved]


  • This topic is locked This topic is locked

#16
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Hello :)

The logs look good, only a music toolbar that needs to be removed. We'll remove it, and take care of the out of date Java program. :thumbsup:

Please disable your antivirus for the duration of my instructions. Don't forget to re-enable it after you have completed the steps.


Step 1: Fix with FRST
  • Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
  • Right-click in the open notepad and select Paste).
  • Save it on the desktop as fixlist.txt

    NOTE: It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

Start
CreateRestorePoint:
C:\Users\SJB\AppData\LocalLow\Vafmusic
End


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.


Run FRST and press the Fix button just once and wait. The tool will make a log on the desktop (Fixlog.txt) please post it in your next reply.


Step 2: Java Warning and JavaRa

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java

Please read this article about Java.

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to disable Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version.

javara_zpshnkbqglv.jpg


Things I need to see in your next post:

Fixlog.txt Log

  • 0

Advertisements


#17
cahagg01

cahagg01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts

I tried twice to uninstall music toolbar, but I guess it won't uninstall.

 

 

Fix result of Farbar Recovery Scan Tool (x64) Version:05-05-2016 01
Ran by SJB (2016-05-04 19:48:58) Run:2
Running from C:\Users\SJB\Desktop
Loaded Profiles: SJB (Available Profiles: SJB)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
C:\Users\SJB\AppData\LocalLow\Vafmusic
End

*****************

Restore point was successfully created.
C:\Users\SJB\AppData\LocalLow\Vafmusic => moved successfully

==== End of Fixlog 19:50:02 ====


  • 0

#18
cahagg01

cahagg01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
I have completed all these steps now
  • 0

#19
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Hello :)

Well, I guess the board decided to eat my last response. Let's remove my tools, and create a new clean restore point on the machine. :thumbsup:


Step 1: Tool Removal with Delfix and Creation of a clean restore point
  • Download Delfix from here
  • Ensure Remove disinfection tools is ticked
    Also tick:
    • Create registry backup
    • Purge system restore
    • Reset System Settings
    delfix.jpg
  • Click Run
The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.
  • You can uninstall ESET Online Scanner at this time.
  • I recommend keeping Malwarebytes Anti-Malware installed. Make sure to update it and run it at least once a week. If it finds things such as PUP's (Potentially Unwanted Programs) you can delete those with no worries. However, if it finds something like a trojan, come see us.
Step 2: Tips, Information, and Optional Installation of Unchecky
  • Watch what you open in your emails. If you get an email from an unknown source with any attached files, do not open it.
  • Install and keep only one anti-virus on your machine. Update it and scan your machine with it at least once a week.
  • Be careful of the websites you visit.
  • When installing new programs, don't be "click happy" and click through the screens. Many programs come with adware in them and are set to install them by default. Several programs require that you uncheck or select no to prevent the installation. Take your time and read each screen as you go. :)
To help protect yourself while on the web, I recommend you read How did I get infected in the first place?

I also recommend reading Miekiemoes Protection Tips


Installation of Unchecky

This is a very good little program that will automatically uncheck any boxes during a software installation. This helps prevent the software from installing any malware that is by default checked while the program is being installed.
  • Click here to be taken to Unchecky.com
  • Click the very large Download button.
  • Click Save
  • Once downloaded, double click the program (Vista, Win 7, and 8, right click and Run as Administrator)
  • Once open, click the Install button.
unchecky1_zps667e512d.jpg


Then click Finish

unchecky2_zpsca4e7d0d.jpg


Unchecky is now installed and will help you keep unwanted check boxes unchecked. :thumbsup:


Step 3: Protection Against CryptoLocker


CryptoLocker is a ransomware program that was released around the beginning of September 2013 that targets all versions of Windows including Windows XP, Windows Vista, Windows 7, and Windows 8. This ransomware will encrypt certain files using a mixture of RSA & AES encryption. When it has finished encrypting your files, it will display a CryptoLocker payment program that prompts you to send a ransom of either $100 or $300 in order to decrypt the files. This screen will also display a timer stating that you have 72 hours, or 4 days, to pay the ransom or it will delete your encryption key and you will not have any way to decrypt your files. This ransom must be paid using MoneyPak vouchers or Bitcoins. Once you send the payment and it is verified, the program will decrypt the files that it encrypted.

Please download and install CryptoPrevent to lock your machine down from this infection.

CryptoPrevent_zps1a3866db.jpg


Things I need to see in your next post

Delfix Log

  • 0

#20
cahagg01

cahagg01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts

# DelFix v1.010 - Logfile created 04/05/2016 at 20:50:14
# Updated 26/04/2015 by Xplode
# Username : SJB - SJB-PC
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\SJB\Desktop\FRST-OlderVersion
Deleted : C:\log.txt
Deleted : C:\Users\SJB\Desktop\Addition.txt
Deleted : C:\Users\SJB\Desktop\AdwCleaner.exe
Deleted : C:\Users\SJB\Desktop\AdwCleaner[C1].txt
Deleted : C:\Users\SJB\Desktop\adwcleaner_3.213.exe
Deleted : C:\Users\SJB\Desktop\Fixlog.txt
Deleted : C:\Users\SJB\Desktop\FRST.txt
Deleted : C:\Users\SJB\Desktop\FRST64.exe
Deleted : C:\Users\SJB\Desktop\JRT.exe
Deleted : C:\Users\SJB\Desktop\JRT.txt
Deleted : C:\Users\SJB\Desktop\JavaRa-2.6.1.1.zip
Deleted : C:\Users\SJB\Downloads\Addition.txt
Deleted : C:\Users\SJB\Downloads\FRST.txt
Deleted : HKLM\SOFTWARE\AdwCleaner

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #223 [Installed AVG 2016 | 05/03/2016 03:15:25]
Deleted : RP #224 [Installed AVG | 05/03/2016 03:16:32]
Deleted : RP #225 [Windows Update | 05/04/2016 01:24:25]
Deleted : RP #227 [Restore Point Created by FRST | 05/04/2016 02:08:24]
Deleted : RP #228 [JRT Pre-Junkware Removal | 05/04/2016 02:28:43]
Deleted : RP #229 [Removed AVG | 05/04/2016 03:07:04]
Deleted : RP #230 [Removed AVG 2016 | 05/04/2016 03:09:45]
Deleted : RP #232 [Windows Modules Installer | 05/04/2016 22:46:40]
Deleted : RP #233 [Windows Modules Installer | 05/04/2016 22:50:47]
Deleted : RP #235 [Restore Point Created by FRST | 05/05/2016 00:49:16]
Deleted : RP #236 [Removed Java 8 Update 40 | 05/05/2016 00:55:02]
Deleted : RP #237 [Windows Update | 05/05/2016 01:09:03]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########


  • 0

#21
cahagg01

cahagg01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
All complete. Any other steps?
  • 0

#22
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

All complete. Any other steps?


Nothing further, the logs are clean. :thumbsup: If we can assist you in the future, please don't hesitate to come see us. :)
  • 0

#23
cahagg01

cahagg01

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
Okay. Thanks bunches!!
  • 0

#24
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

Okay. Thanks bunches!!


You're very welcome. :)

Safe surfing!

Pystryker :wave:
  • 0

#25
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.


  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP