[Buddierdl]

Hi Ren12,

I also have spyhunter. Should I also uninstall that as well?

I would recommend just keeping your anti-virus (Microsoft Security Essentials) and Malwarebytes. This is all you really need (plus the Windows firewall).

NOthing seems to be missing but the documents section of my folder seems to have music and my videos folders that I can't acess when I click them. I can still acess my music and my videos on my real folder but there seems to be folders that I didn't previously have on my documents section.

Why is there a folder with my name and a folder with everything on my hardrive on my desktop even though I didn't put them there.

That's really creeping me out.

Another weird thing. On my music folder I have stuff I have never put there. They are all pictures related to the bands I listen to but they were never in my music folder before. Idk why they are there.

Could you take a screenshot of these so that I can see? They may just be hidden files that are being shown because of some of our fixes. If so, they will go away when we clean up.

Let's sweep for remnants.

Step 1: Run SecurityCheck

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step 2: Run MBAM.

• Please open Malwarebytes and update the definitions.
• Next, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Step 3: Run online scan.

Run ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is Not checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files (x86)\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Things I need in your next reply:

• SecurityCheck log
• MBAM log
• ESET log
• Any outstanding problems?

[Advertisements]

Umm yeah I don't think it's a big deal. It's just that on my music folder I only have music on it, but there seems to be pictures "album arts" that I never put there. Most likely not a big deal bit I'll give you the screenshot anyways. I'll delete them anyways since they are not meant to be there.

I think spyhynter is okay. I don't like MSE and MBA that much simply because they don't do much to prevent a virus.



Results of screen317's Security Check version 0.99.57
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
JavaFX 2.1.1
Java™ 6 Update 29
Java™ 7 Update 5
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.5.502.146
Adobe Reader 10.1.1 Adobe Reader out of Date!
Mozilla Firefox (18.0.1)
Google Chrome 23.0.1271.97
Google Chrome 24.0.1312.52
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````





Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.31.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Renato :: RENATO-PC [administrator]

7/31/2012 4:42:29 PM
mbam-log-2012-07-31 (16-42-29).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 202219
Time elapsed: 4 minute(s), 59 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Renato\Downloads\PopularScreenSavers.exe (PUP.FunWebProducts) -> Quarantined and deleted successfully.

(end)



Will post the ESET log shortly.

Edited by Ren12, 22 January 2013 - 06:22 PM.

[Ren12]

Umm yeah I don't think it's a big deal. It's just that on my music folder I only have music on it, but there seems to be pictures "album arts" that I never put there. Most likely not a big deal bit I'll give you the screenshot anyways. I'll delete them anyways since they are not meant to be there.

I think spyhynter is okay. I don't like MSE and MBA that much simply because they don't do much to prevent a virus.



Results of screen317's Security Check version 0.99.57
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
JavaFX 2.1.1
Java™ 6 Update 29
Java™ 7 Update 5
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.5.502.146
Adobe Reader 10.1.1 Adobe Reader out of Date!
Mozilla Firefox (18.0.1)
Google Chrome 23.0.1271.97
Google Chrome 24.0.1312.52
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````





Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.31.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Renato :: RENATO-PC [administrator]

7/31/2012 4:42:29 PM
mbam-log-2012-07-31 (16-42-29).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 202219
Time elapsed: 4 minute(s), 59 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Renato\Downloads\PopularScreenSavers.exe (PUP.FunWebProducts) -> Quarantined and deleted successfully.

(end)



Will post the ESET log shortly.

Edited by Ren12, 22 January 2013 - 06:22 PM.

[Ren12]

Seems like I had another crash once again, once I tried to open my sound control panel. Could this be related to my sound card.

Essenbox will tell you about (a proble I used to have) but this is definitely more bizzare).

[Ren12]

ake sure that the option Remove found threats is Not checked, and the option Scan archives is checked.

This is kind of counter intuitive to me? I made sure not to check the remove found but isn't that the point of this can?


Anyways, the scan is taking more then I expected but it seems to have found the threats.

Edited by Ren12, 22 January 2013 - 08:00 PM.

[Buddierdl]

Just be patient on the ESET scan. It can take a long time.

We don't automatically remove things because it has some false positives and sometimes it has a tendency to ruin system restore points.

When the scan is done, post the log and I will show how/what to remove.

[Ren12]

Just be patient on the ESET scan. It can take a long time.

We don't automatically remove things because it has some false positives and sometimes it has a tendency to ruin system restore points.

When the scan is done, post the log and I will show how/what to remove.

Hmm okay that makes sense.

Btw is it possible that the virus knows what we are doing and so it constantly changes to evade us?

Just something I've been wondering.

[Ren12]

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6889
# api_version=3.0.2
# EOSSerial=da40ef2fa30d204e81aa10ad6b1b7bdc
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-01-23 04:47:53
# local_time=2013-01-22 11:47:53 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 47301795 110459923 0 0
# scanned=434223
# found=15
# cleaned=0
# scan_time=20484
C:\ProgramData\Microsoft\Windows\DRM\18F.tmp Win64/Olmarik.AO trojan E8744B6F671008F91DFCA2F889782E4AAFA05037 I
C:\ProgramData\Microsoft\Windows\DRM\18F.tmp.dat a variant of Win32/Kryptik.AQQU trojan 0D4197B8114D2F8466093DBFCD9AA485402AEFD6 I
C:\ProgramData\Microsoft\Windows\DRM\1A0.tmp Win64/Olmarik.AO trojan 650A5F543973E48043DF4763FA465EEBB4D49201 I
C:\TDSSKiller_Quarantine\04.08.2012_16.11.42\tdlfs0000\tsk0000.dta Win32/Olmarik.AYI trojan 0630117B267D6A0034443902377A4E136F34523B I
C:\TDSSKiller_Quarantine\04.08.2012_16.11.42\tdlfs0000\tsk0001.dta Win64/Olmarik.AK trojan F281E8D97D77A6578BF8EA9290BEF4BBE02EF3FE I
C:\TDSSKiller_Quarantine\04.08.2012_16.11.42\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan B6A8387A82AE5B7E732B04484690E5CAA8DA5DBC I
C:\TDSSKiller_Quarantine\04.08.2012_16.11.42\tdlfs0000\tsk0003.dta Win64/Olmarik.AL trojan 297CA0907D08374145FBBF4836BF6209946926B2 I
C:\Users\All Users\Microsoft\Windows\DRM\18F.tmp Win64/Olmarik.AO trojan E8744B6F671008F91DFCA2F889782E4AAFA05037 I
C:\Users\All Users\Microsoft\Windows\DRM\18F.tmp.dat a variant of Win32/Kryptik.AQQU trojan 0D4197B8114D2F8466093DBFCD9AA485402AEFD6 I
C:\Users\All Users\Microsoft\Windows\DRM\1A0.tmp Win64/Olmarik.AO trojan 650A5F543973E48043DF4763FA465EEBB4D49201 I
C:\Users\Renato\AppData\Local\Google\Chrome\User Data\Default\Default\aadhgeddddgcdfgdgddggbdbdegddcde\background.html Win32/BHO.OEI trojan D99482D9A6FD35FFCA50D67F35964F27316201C5 I
C:\Users\Renato\AppData\Local\Google\Chrome\User Data\Default\Default\aadhgeddddgcdfgdgddggbdbdegddcde\ContentScript.js Win32/BHO.OEI trojan 3113662D84508DD67BCEDA10E4F08903300B8485 I
C:\Users\Renato\Downloads\openofficewriter-setup.exe Win32/DownloadAdmin.A.Gen application 5DC875290A347EDC60EECB26C7A06CD39C6B4050 I
C:\Users\Renato\Downloads\VeohWebPlayerSetup_us.exe a variant of Win32/InstallBrain.R application 2A564F9A8C5B8B8F23EC9446F8A5AA4894D059AB I
C:\_OTL\MovedFiles\01192013_114520\C_Users\Renato\AppData\Roaming\Mozilla\Firefox\Profiles\04uebt4x.default\extensions\[email protected] JS/Redirector.NCA trojan BBF5054CB48B108A3F812C7CDC8117AE0C1D9C21 I

[Buddierdl]

Hi Ren12,

Busy day today. Next fix should be coming in the morning.

[Buddierdl]

Hi Ren12,

but there seems to be pictures "album arts" that I never put there.

Often programs like Windows Media Player or Itunes automatically download album art.

Seems like I had another crash once again, once I tried to open my sound control panel. Could this be related to my sound card.

Essenbox will tell you about (a proble I used to have) but this is definitely more bizzare).

I looked at your other thread and it does seem to be a strange problem. It's kind of out of my area of knowledge.When we are done here, I would suggest starting a topic in the Hardware Forum. The techs there will be better able to help you with this.

Btw is it possible that the virus knows what we are doing and so it constantly changes to evade us?

Your computer is almost clean now. The following step should clean up the rest.

Start OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following

  :Commands
  [createrestorepoint]
  
  :Files
  C:\ProgramData\Microsoft\Windows\DRM\18F.tmp
  C:\ProgramData\Microsoft\Windows\DRM\18F.tmp.dat
  C:\ProgramData\Microsoft\Windows\DRM\1A0.tmp
  C:\Users\All Users\Microsoft\Windows\DRM\18F.tmp
  C:\Users\All Users\Microsoft\Windows\DRM\18F.tmp.dat
  C:\Users\All Users\Microsoft\Windows\DRM\1A0.tmp
  C:\Users\Renato\AppData\Local\Google\Chrome\User Data\Default\Default
  C:\Users\Renato\Downloads\VeohWebPlayerSetup_us.exe
  
  :Commands
  [emptytemp]

• Then click the Run Fix button at the top
• Let the program run unhindered.
• Post the log it produces in your next reply. The log should be saved in C:\_OTL\MovedFiles and should be named with numbers describing the date and time it was run.

[Ren12]

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
C:\ProgramData\Microsoft\Windows\DRM\18F.tmp moved successfully.
C:\ProgramData\Microsoft\Windows\DRM\18F.tmp.dat moved successfully.
C:\ProgramData\Microsoft\Windows\DRM\1A0.tmp moved successfully.
File\Folder C:\Users\All Users\Microsoft\Windows\DRM\18F.tmp not found.
File\Folder C:\Users\All Users\Microsoft\Windows\DRM\18F.tmp.dat not found.
File\Folder C:\Users\All Users\Microsoft\Windows\DRM\1A0.tmp not found.
C:\Users\Renato\AppData\Local\Google\Chrome\User Data\Default\Default\aadhgeddddgcdfgdgddggbdbdegddcde folder moved successfully.
C:\Users\Renato\AppData\Local\Google\Chrome\User Data\Default\Default folder moved successfully.
C:\Users\Renato\Downloads\VeohWebPlayerSetup_us.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Renato
->Temp folder emptied: 11782146 bytes
->Temporary Internet Files folder emptied: 6331854 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 351772161 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3519 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1710637 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21249827 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 49554 bytes
RecycleBin emptied: 39249403 bytes

Total Files Cleaned = 412.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 01242013_171750

Files\Folders moved on Reboot...
C:\Users\Renato\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.
File move failed. C:\Windows\temp\logishrd\LVPrcInj02.dll scheduled to be moved on reboot.
File\Folder C:\Windows\temp\hsperfdata_RENATO-PC$\1712 not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


Sorry I can't reply to you in the morning. Unfortunately I'm at school during the time you reply back to me.

Edited by Ren12, 24 January 2013 - 04:33 PM.

[Buddierdl]

Congratulations, Ren12 . Your computer now appears to be clean. Please complete the followings steps to finalize the cleaning process. Please make sure to run the OTL cleanup as you still have some files in quarantine from your previous thread with Essexboy.

It would be a good idea also to reset your firewall in case the malware opened any ports.

Please update these programs, as old versions pose a security risk.

• Java
  
  WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
  See this article and this article.
  I would recommend that you completely uninstall Java unless you need it to run an important software.
  In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)
  
  If you do need java, then you should definitely update to the latest version:
  
  Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, then click Remove JRE.
  • Run the built-in uninstallers for all copies of java listed
  • Click the Next button
  • Click the Next button again
  • Click the Java Manual Download link
  • A browser window will open with the Java download page
  • Click the Windows Offline (32-bit) or Windows Offline (64-bit) link to download Java (based on your browser type)
  • Run the installer
  • Close JavaRa
• Adobe Flash -> You can get the latest version here.
• Adobe Reader -> You can get the latest version here.
  
  I would recommend securing Adobe Reader against the latest exploits as follows:
  • Launch Adobe Reader.
  • Click on Edit and select Preferences.
  • On the Left, click on the Javascript category and Uncheck Enable Acrobat Javascript.
  • Click on the Security (Enhanced) category and Uncheck Automatically trust sites from my Win OS security zones.
  • Click on the Trust Manager category and Uncheck Allow opening of non-PDF file attachments with external applications.
  • Click the OK button.

Clean up OTL:

• Open OTL and select the "CleanUp" button.
• Allow the computer to reboot.
• Any logs or removal tools left over can be deleted now. If ESET is still installed, you can uninstall it from the "Programs and Features" menu in the control panel.

Delete possibly infected restore points. Your computer may have saved a restore point while it was infected, so we need to delete the old restore points and create a new, clean one.

First set up a new, clean restore point:

• Open System by clicking the Start button, right-clicking Computer, and then clicking Properties.
• In the left pane, click System protection. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
• Click the System Protection tab, and then click Create.
• In the System Protection dialog box, type a description, and then click Create.

Then delete the old, infected ones:

• Go Start > All Programs > Accessories > System Tools
• Right click Disc Cleanup and select run as administrator
• Then select the more options tab
• Select system restore and shadow copies "Clean up"
• Follow the prompts

Empty temp files. I would recommend doing this every so often to free up some space on your computer.

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Ensure that Windows is always updated. Keeping Windows updated is very important to prevent security vulnerabilities. I recommend turning on automatic updates following the instructions below:

• First, click on Start and click onAll Programs, then Windows Update.
• Click on Change Settings in the left pane and then check the option for Automatic Updates.

Always ensure that your firewall and anti-virus program are updated and running. These are your first line of defense against infection.

Make sure that you keep all of your programs updated. Out-of-date programs can make your computer more vulnerable to infection. Software manufacturers release updates to fix security problems as they are discovered. Secunia Personal Software Inspector, free to download here, is a good program that will scan your computer looking for programs that need to be updated.

This article has good information about how computers get infected. You can read it for good tips on staying clean and safe.

[Ren12]

Btw whenever I open a new program my windows firewall is asking me whether I should allow it to connect to private and/or public network.


I completely uninstalled Java as i think it was safe and downloaded adobe and whatnot that you linked.


The ultimate way to test this is to see if I can run the new games and whatnot.

[Ren12]

Looks like I'm still getting the web browser crashes.

IT says adobe flash has crashed.

And I can't open games either.





Maybe it's unrelated to a virus? http://support.mozil...d-video-firefox

Edited by Ren12, 25 January 2013 - 06:03 PM.

[Ren12]

This is quite an annoying problem and it buffles me because I was sure we had it when the ESET spotted the viruses.

[Buddierdl]

Hi Ren12,

Btw whenever I open a new program my windows firewall is asking me whether I should allow it to connect to private and/or public network.

This is because we reset the firewall.

Looks like I'm still getting the web browser crashes.

IT says adobe flash has crashed.

And I can't open games either.

I don't believe this is related to malware. My best advice would be to uninstall flash from the control panel and reinstall it from here.

I would also try playing the games in IE to see if the same problem happens in that browser.

Otherwise, it would probably be best to refer to the techs in the Software Forum. They can probably help you better than I in this area.