Jump to content

Fake system scan


Eric72

Recommended Posts

Welcome to the forum.

See if following this guide works.

Make sure you run rkill and/or exeHelper and then immediately run MBAM as desribed.

Most important....update MBAM before you run it.

The link below explains how to rename MBAM if needed:

http://forums.malwarebytes.org/index.php?showtopic=55485&view=findpost&p=274963

Post the logs back here, Good Luck....MrC

Link to post
Share on other sites

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

Link to post
Share on other sites

Please do this:

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
    O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
    O4 - HKU\S-1-5-21-2844847763-3726028296-3422661878-1000..\Run: [FNFPDoJienHIJQ.exe] C:\ProgramData\FNFPDoJienHIJQ.exe ()
    [2011/12/09 10:22:19 | 000,000,000 | ---D | C] -- C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
    [2011/12/09 10:53:46 | 000,000,320 | ---- | M] () -- C:\ProgramData\~xCqSA691PCS5A4
    [2011/12/09 10:53:46 | 000,000,232 | ---- | M] () -- C:\ProgramData\~xCqSA691PCS5A4r
    [2011/12/09 10:53:16 | 000,000,456 | ---- | M] () -- C:\ProgramData\xCqSA691PCS5A4
    [2011/12/09 10:51:31 | 000,000,629 | ---- | M] () -- C:\Users\Eric\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
    [2011/12/09 10:22:19 | 000,000,605 | ---- | M] () -- C:\Users\Eric\Desktop\System Fix.lnk
    [2011/12/09 10:22:12 | 000,349,320 | ---- | M] () -- C:\ProgramData\xCqSA691PCS5A4.exe
    [2011/12/09 10:19:48 | 000,440,968 | ---- | M] () -- C:\ProgramData\FNFPDoJienHIJQ.exe
    [2011/12/09 10:51:31 | 000,000,629 | ---- | C] () -- C:\Users\Eric\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
    [2011/12/09 10:22:19 | 000,000,320 | ---- | C] () -- C:\ProgramData\~xCqSA691PCS5A4
    [2011/12/09 10:22:19 | 000,000,232 | ---- | C] () -- C:\ProgramData\~xCqSA691PCS5A4r
    [2011/12/09 10:22:16 | 000,000,456 | ---- | C] () -- C:\ProgramData\xCqSA691PCS5A4
    [2011/05/21 13:29:20 | 000,001,482 | -HS- | C] () -- C:\Users\Eric\AppData\Local\e4p658450oy660al14dx
    [2011/05/21 13:29:20 | 000,001,482 | -HS- | C] () -- C:\ProgramData\e4p658450oy660al14dx
    [2011/05/19 09:21:46 | 000,007,998 | -HS- | C] () -- C:\Users\Eric\AppData\Local\405a481v1p73r00sd4854fqwg0637xef60j3i2n5xlhy
    [2011/05/19 09:21:46 | 000,007,998 | -HS- | C] () -- C:\ProgramData\405a481v1p73r00sd4854fqwg0637xef60j3i2n5xlhy
    [2011/05/16 19:37:34 | 000,002,720 | -HS- | C] () -- C:\Users\Eric\AppData\Local\87f84b07txx0r24302jh1v
    [2011/05/16 19:37:34 | 000,002,720 | -HS- | C] () -- C:\ProgramData\87f84b07txx0r24302jh1v
    [2011/05/08 17:07:01 | 000,005,246 | -HS- | C] () -- C:\Users\Eric\AppData\Local\r74o1p54t2
    [2011/05/08 17:07:01 | 000,005,246 | -HS- | C] () -- C:\ProgramData\r74o1p54t2
    [2011/04/30 15:04:21 | 000,007,840 | -HS- | C] () -- C:\Users\Eric\AppData\Local\47h7308i05434q7ml6uhge302
    [2011/04/30 15:04:21 | 000,007,840 | -HS- | C] () -- C:\ProgramData\47h7308i05434q7ml6uhge302
    [2011/04/08 08:36:53 | 000,003,036 | -HS- | C] () -- C:\Users\Eric\AppData\Local\bkels6fq4t8a1c772
    [2011/04/08 08:36:53 | 000,003,036 | -HS- | C] () -- C:\ProgramData\bkels6fq4t8a1c772
    [2011/04/04 22:14:45 | 000,010,120 | -HS- | C] () -- C:\Users\Eric\AppData\Local\0810l5u6odc6bt4h
    [2011/04/04 22:14:45 | 000,010,120 | -HS- | C] () -- C:\ProgramData\0810l5u6odc6bt4h


  • Then click the Run Fix button at the top
  • Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  • Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

------------------------------------

Then........

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Make sure you run ComboFix from your desktop.

Please include the C:\ComboFix.txt in your next reply for further review.

MrC

Link to post
Share on other sites

That's Good News!

Your Java is out of date: Java 6 Update 26 <---should be 29

Look in your control panel for Java > click on update tab > update

------------------------------------

Please uninstall ComboFix:

Click on the Start button and then in the Search field enter combofix /uninstall

Please note that there is a space between combofix and /uninstall.

Once you have typed this in, press Enter on your keyboard. A Open File security warning will appear asking if you are sure you want to run ComboFix. Please click on the Run button to start the program.

ComboFix will now uninstall itself from your computer and remove any backups and quarantined files. When it has finished you will be greeted by a dialog box stating that ComboFix has been uninstalled. You can now delete the ComboFix.exe program from your computer. ComboFix has now been uninstalled from your Windows Vista or Windows 7 computer.

-----------------------------------

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

-----------------------------------

Any questions...please post back.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, Have a Good Holiday and New Year, MrC

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.