Please help can't get rid of Trojan:JS/Medfos.B

[mattbiel]

I have run MBAM and MSE and MSE detects it and says it removes it but when I reboot and scan MSE finds it again so it's not removing it.

I have looked at these forums and already run some of the tools suggested. I am attaching logs for dds.com, security check, adwcleaner, and roguekiller.

Thank you in advance for your help!

AdwCleanerS2.txt

attach.txt

dds.txt

RKreport1_S_01052013_02d0820.txt

security check.txt

[MrCharlie]

Welcome to the forum.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
  
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete depending on your system's specifications.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message.
  

Then............

Run.....

http://www.microsoft.com/security/scanner/en-us/default.aspx <---------Microsoft Safety Scanner

MrC

[mattbiel]

Thank you for taking the case, MrCharlie!

Here are the contents of the jrt log file:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.3.8 (01.03.2013:2)

OS: Windows 7 Home Premium x64

Ran by Brouwer on Sat 01/05/2013 at 9:46:21.77

Blog: http://thisisudax.blogspot.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Brouwer\AppData\Roaming\systweak"

Successfully deleted: [Folder] "C:\Program Files (x86)\regclean pro"

~~~ Chrome

Dumping contents of C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default

C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default\aagddididadggcggdcggdhdbdeddddge

C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default\aagddididadggcggdcggdhdbdeddddge\background.html

C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default\aagddididadggcggdcggdhdbdeddddge\background.js

C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default\aagddididadggcggdcggdhdbdeddddge\ContentScript.js

C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default\aagddididadggcggdcggdhdbdeddddge\manifest.json

Successfully deleted: [Folder] C:\Users\Brouwer\appdata\local\Google\Chrome\User Data\Default\Default [Default Extension 1.0]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sat 01/05/2013 at 9:50:57.19

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I am currently scanning with Microsoft Safety Scanner

[mattbiel]

Microsoft Safety scanner came out clean. Do the logs appear that everything is ok?

[MrCharlie]

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

[mattbiel]

Thank you mrcharlie! Computer is working great and that virus has been removed. I appreciate your help.

Matt

[MrCharlie]

Great............

From your security check:

Java 7 Update 10 <---this is OK

Java version out of Date! <---OK

You have 2 versions on the system and both are out of date.

Please uninstall them and install the latest version from the link below:

http://get.adobe.com/reader/?no_ab=1

Adobe Reader 9 Adobe Reader out of Date!

Adobe Reader 10.1.4 Adobe Reader out of Date!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

You have out dated programs on the system which are vulnerable to malware.

Please update or uninstall them

Info on doing that can be found in my Preventive Maintenance

~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!