[drlnb]

Render,

 

Here is what was in the log.txt file?

 

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
 

Should I try a reinstall and run eset again?

 

Thanks once again for all your help!

[Advertisements]

Yes, please try to run it one more time.

[Render]

Yes, please try to run it one more time.

[drlnb]

Render,

 

Here you go:

 

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=8
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=0b4741d0e10c214984272ca21af17b6f
# engine=18552
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-10 05:50:39
# local_time=2014-06-10 01:50:39 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode_1='McAfee VirusScan Enterprise'
# compatibility_mode=5126 16777213 100 98 31735222 160451019 0 0
# scanned=165815
# found=1
# cleaned=1
# scan_time=3414
sh=462FAB2D993D0E9C36B8F8C2F22980FE22F4DF2F ft=0 fh=0000000000000000 vn="HTML/Ransom.P trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Documents and Settings\wjabs\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp6ueysr.default\Cache\2\AA\6CF90d01"
 

[Render]

Update to Wondows XP3 - Windows XP Service Pack 3 (SP3) is an important update that includes previously released security, performance, and stability updates for Windows XP.

You can download Service pack 3 from here and install it manually.
 

[drlnb]

Render,

 

Done!

 

Thanks

[Render]

Please download Malwarebytes Anti-Malware to your desktop
Install the progamme and select update
Once it has updated select Settings > Detection and Protection
Tick Scan for rootkits



Go back to the Dashboard and select Scan Now



If threats are detected, click the Apply Actions button, MBAM will ask for a reboot.





On completion of the scan (or after the reboot) select View Detailed Log
Select Export > Select text file and save to the desktop.
Post that log.

[drlnb]

Render,

 

Here you go.

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 6/15/2014
Scan Time: 5:09:42 PM
Logfile: mal.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.15.05
Rootkit Database: v2014.06.02.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: wjabs

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 288461
Time Elapsed: 39 min, 15 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Malware.Trace, c:\winnt\web\printers\images\navdb.dbx, Delete-on-Reboot, [e8cae98aa8d377bf7a767590fd060ff1],

Physical Sectors: 0
(No malicious items detected)


(end)

[Render]

Looks good from logs. Can you please give me an update on how your computer's running.

Notice: With the end support for Windows XP, machines running this OS are more vulnerable than ever. There will be no more updates to close any found vulnerabilities in the software.

Please consider an upgrade to Windows 7. You can check and see if your machine is capable of running it by clicking this link.

[drlnb]

Render,

 

The pc seems to be running fine now.  I'm going to look at upgrading to 7.

 

Thanks

[Render]

Your logs shows that your system is clean. If you have no further issues with your computer, then please proceed with the following procedures outlined below.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article Strong passwords: How to create and use them.

Removing the tools we used:

Uninstall ComboFix

Remove Combofix now that we're done with it.

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now copy/paste this: ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /Uninstall, it needs to be there.
  

  

• Please follow the prompts to uninstall Combofix.
• This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

NEXT...

Clean-Up:

• Please go here to download OTC.
• Run this program to remove most of the tools we have been using.
• If you are asked to reboot the machine to finish the Cleanup process choose Yes.
• Any remaining tools may be deleted. That includes the ones you have downloaded including ComboFix.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

A reminder: Remember to (re-install if uninstalled during cleaning) update and turn back on any anti-malware programs you may have turned off during the cleaning process.

There are a few things I recommend you to do once your computer is completely clean:

Updates for other installed software

A common attack method for hacking attempts and malware installs is to exploit known vulnerabilities in programs that are commonly installed on a person's computer. These vulnerabilities could allow a remote user or malware developer to install malware, keyloggers, and backdoors on to your computer without your knowledge or permission.
Some of the programs that are commonly exploited include Adobe Shockwave, Adobe Reader, Sun Java, Adobe Flash, and even Windows itself. Therefore it is crucial that everyone remain vigilant as to when a security vulnerability is found in our installed programs and to update it when a security update is released. Unfortunately, no one has the time to stay on top of these updates, which can happen frequently.

I highly recommend you to install Secunia Personal Software Inspector (PSI) that can be used to scan your computer for known vulnerable programs, provide information on the vulnerability, and provide a location to an update for the vulnerable program. A tutorial on how to use Secunia Personal Software Inspector (PSI) can be found here: Keep Software Updated with Secunia PSI.

Tips to protect yourself against malware and reduce the potential for re-infection:

CryptoLocker Warning

There is a particularly nasty infection out there at the moment.
Go here for information about CryptoLocker Ransomeware
Download CryptoPrevent free for home use.

• Simple and easy ways to keep your computer safe.
• Hardening Windows Security - Part 1 & Part 2.
• Use Task Manager to close pop-up messages to safely exit malware attacks.
• How to Secure Your Web Browser.

Now after all these steps, your PC will be more secure. However it is important to note that you can still get infected if you are not careful. One of the best security programs you can have is common sense. As malware gets more sophisticated, you need to be more wary. If you do get caught though and the above steps can't help prevent it, we will be here to help you out.

Stay secure and thank you for choosing GeeksToGo.

[drlnb]

Render,

 

Let me thank you for all your help here.  No words can express my gratitude.

 

Thank you again!

 

drlnb

 

p.s

 

This also has popped up a couple of times?

 

 

 

Attached Thumbnails

• 

Edited by drlnb, 23 June 2014 - 09:45 AM.

[Render]

Hi and sorry for late reply.

 

This also has popped up a couple of times?

 

How often does this occur?

[drlnb]

Render,

 

This popped up twice.  I think eset deleted the first time and Malware deleted the second time.  I have not seen it since.

 

drlnb

[Render]

It's OK than. If you have any other issue, please don't hesitate to ask.