[Casshern]

Oh thats just my external hard drive, I use it to ferry around coursework and my collection of online comics. I've already scanned it too and nothing came up bad with it. Update on the scanner, its scanning through all my steam apps and is on 99% so it'll probably be done soon, as the steam folder is quite large due to the number of games I've got on it.

edit: I'm going to take a random guess and say that the external came up as fake because its an external, I'm really not sure, there doesn't seem to be anything wrong with it as its almost completely empty anyway, just a few bits of coursework on there at the moment.

Edited by Casshern, 23 February 2011 - 04:34 AM.

[Advertisements]

Hey sorry for the long delay between posts, that 2nd scan took much longer and went all the way to 99% in the first 20 minutes then all this time its been scanning at 99%, It picked up on 3 Infections, 2 Trojans and another Virus. I take it that it deleted them, so whats the next step, Thanks for all the help so far!

C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\21bbb478-380859ed probably a variant of Win32/Agent.RPSVWU trojan cleaned by deleting - quarantined
C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\9b47178-33b3c161 a variant of Java/TrojanDownloader.Agent.NAN trojan deleted - quarantined
C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\26eb6ffb-141eaa03 a variant of Java/TrojanDownloader.OpenStream.NBE trojan deleted - quarantined

[Casshern]

Hey sorry for the long delay between posts, that 2nd scan took much longer and went all the way to 99% in the first 20 minutes then all this time its been scanning at 99%, It picked up on 3 Infections, 2 Trojans and another Virus. I take it that it deleted them, so whats the next step, Thanks for all the help so far!

C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\21bbb478-380859ed probably a variant of Win32/Agent.RPSVWU trojan cleaned by deleting - quarantined
C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\9b47178-33b3c161 a variant of Java/TrojanDownloader.Agent.NAN trojan deleted - quarantined
C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\26eb6ffb-141eaa03 a variant of Java/TrojanDownloader.OpenStream.NBE trojan deleted - quarantined

[Salagubang]

Hi,

What the results basically says is that you have Outdated Java

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
• Look for "JDK 6 Update 23 (JDK or JRE)".
• Click the "Download JRE" button to the right.
• Select your Platform: "Windows".
• Select your Language: "Multi-language".
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
• Click Continue and the page will refresh.
• Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
• Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u23-windows-i586.exe to install the newest version.
• If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
• When the Java Setup - Welcome window opens, click the Install > button.
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note:
The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.
To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
Click Ok and reboot your computer.

++++++++++++++++++++++++++++++

What I would like you to do in the meantime (while I consult the oracles), is give your machine a test drive for a day and see if will bonk out while doing the runs. Update me if all issues have been resolved.

[Casshern]

Its worked great all day, Think its all fixed. Thanks mate your amazing!

[Salagubang]

Hi Casshern,

Nice Job.

Wrapping up.

We need to remove all the tools that you have used.
This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.

Remove Other Tools

• Download OTC to your desktop and run it
• Click CleanUp! to begin the cleanup process and remove our tools, including this application
• You may be asked to reboot the machine to finish the cleanup process - if so, choose Yes

Lets Re-hide system files and folders.
Opening Windows Explorer (to get there right-click your Start button and go to "Explore"), please do the following:

• Go to Tools (drop-down menu at the top of the window)
• Go down and click Folder Options
• Click on the View tab
• Find the Hidden Files and Folders section of the box and check "Do not show hidden files and folders"
• Again under Hidden Files and Folders, find "Hide protected operating system files (Recommended)" and check it (if it's already checked)
• Click Apply, and then Ok at the bottom.
• Close the window

++++++++++++++++++++++++++++++++++++

Other things to keep in mind.

Windows, Java, and Adobe products should all be kept up-to-date on a regular basis so the latest security fixes are in place on your computer. Please refer to the following links on how to manage these products.

• Windows Update (2000/XP) or Windows Update (Vista)
• Java
• Adobe Reader
• Adobe Flash Player

Here are a few other applications you might consider. Keeping your temporary file area clean, your Windows registry backed up, and backing up your important data are all good techniques.

• Flush Flash - by Bobbi Flekman - cleans Flash Player cookies
• ERUNT (Emergency Recovery Utility NT) - a registry backup utility
• Cobian Backup - a very good backup utility - read the tutorial here
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
• Green to go
• Yellow for caution
• Red to stop

WOT has an addon available for Chrome and Opera.
Please remember that just having these programs is not enough. You must use them. Running a full spyware scan weekly, a full virus scan monthly, and checking for updates and cleaning your temporary files periodically is very important in keeping your computer in tip-top shape.

Finally, please take the time to read the following articles. Applying this information will help prevent future infections:

How to prevent malware by miekiemoes
Preventing Malware and Safe Computing by Rorschach112

This article will help you understand how you may have gotten infected:
How did I get infected in the first place?

Remember, you have to be smarter than the bad guys! Be safe out there!

[Salagubang]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.