persistent TrojanDownloader:Java/Toniper virus

[longrange]

Dear Helper(s):

Please note the following:

(1) Microsoft Security Essentials (MSE) detects the Toniper virus but is unable to completely remove it. (please see attached Picture1 and Picture2)

(2) MalwareBytes is unable to detect Toniper. I have not yet reported a False Positive.

DDS and ATTACH text files are attached.

Any assistance will be greatly appreciated!

attach.txt

dds.txt

[Maniac]

Hello longrange and ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

• If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
  
• I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  
• Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  
• Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  
• Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  
• Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.
  

Step 1

Please uninstall this application: vShare Plugin

Step 2

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
  
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete depending on your system's specifications.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message.
  

Step 3

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older versions of Java components and upgrade the application.

Upgrading Java :

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, then click Remove JRE.
  
• Run the built-in uninstallers for all copies of java listed
  
• Click the Next button
  
• Click the Next button again
  
• Click the Java Manual Download link
  
• A browser window will open with the Java download page
  
• Click the Windows Offline (32-bit) or Windows Offline (64-bit) link to download Java (based on your browser type)
  
• Run the installer
  
• Close JavaRa

[longrange]

Dear Maniac,

Thank you for the 3-step process that you have laid out.

Before I proceed, I do have a question regarding Step 3.

Am I to understand that this will re-install Java onto my computer? From reading the recent news coverage, I am under the impression that Java is still not safe to use. Please see the link below and you will see what I mean:

http://news.cnet.com/8301-1009_3-57563951-83/homeland-security-still-advises-disabling-java-even-after-update/

I will await your response before proceeding further.

Thank you!

LongRange

[Maniac]

This tool will clean any leftovers on your system, but if you decide to not use Java anymore, you are free to proceed without it. Just use to clean the leftovers, that's my point and that's the important task, because there are some vulnerable files.

[longrange]

Maniac,

Thank you for the clarification.

I have pasted the log file below. (JRT.txt)

Please advise if any further steps are required.

LongRange

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.5.2 (01.26.2013:2)

OS: Windows 7 Home Premium x64

Ran by Administator on Wed 01/30/2013 at 17:26:34.02

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{043c5167-00bb-4324-af7e-62013faedacf}

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL

~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\conduit

Successfully deleted: [Registry Key] hkey_local_machine\software\conduit

Successfully deleted: [Registry Key] hkey_current_user\software\zugo

Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{043c5167-00bb-4324-af7e-62013faedacf}

Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"

Successfully deleted: [Registry Key] "hkey_current_user\software\pip"

Successfully deleted: [Registry Key] "hkey_local_machine\software\pip"

~~~ Files

Successfully deleted: [File] "C:\Program Files (x86)\mozilla firefox\plugins\npcouponprinter.dll"

Successfully deleted: [File] "C:\Program Files (x86)\mozilla firefox\plugins\npmozcouponprinter.dll"

~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\coupons"

~~~ FireFox

Successfully deleted the following from C:\Users\Administator\AppData\Roaming\mozilla\firefox\profiles\elcvyejb.default\prefs.js

user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,{20a82645-c095-46ed-80e3-08825760534b}:1.2.1,{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20,

user_pref("extensions.vshare@toolbar.update.enabled", false);

Emptied folder: C:\Users\Administator\AppData\Roaming\mozilla\firefox\profiles\elcvyejb.default\minidumps [14 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 01/30/2013 at 17:32:54.96

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JRT.txt

[longrange]

Please Note that I have re-run Microsoft Security Essentials and it appears that the Java Toniper bug is still resident on my system.

Please see attached screenshots.

[Maniac]

Did you use JavaRa as I instructed you? Could you please post JavaRa.txt content?

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!