dennisl Posted January 9, 2014 Author ID:775733 Share Posted January 9, 2014 It came back againLog files attached mbam-log-2014-01-09 (12-22-49).txtMBAM-log-2014-01-09 (13-14-25).txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 9, 2014 ID:775736 Share Posted January 9, 2014 The log says : No action taken. Please delete these files....MrC Link to post Share on other sites More sharing options...
dennisl Posted January 9, 2014 Author ID:775743 Share Posted January 9, 2014 The first one says deleted & the second shows it returned. Link to post Share on other sites More sharing options...
MrCharlie Posted January 9, 2014 ID:775890 Share Posted January 9, 2014 Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal.Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.Make sure that everything is checked, and click Remove Selected.Then......(please create a new system restore point before running Vipre)Download VIPRE Rescue to the infected computer.http://www.vipreantivirus.com/live/Download2/Navigate to the directory that contains the VIPRE Rescue Program.Double-click on viprerescue?????.exeAt the prompt, "Do you wish to extract the VIPRE Rescue Scanner to your computer?" click Yes.You will be prompted for a destination folder to unzip to. Keep the default (C:\VIPRERESCUE) or enter a new folder, then click Unzip. Make sure the checkbox for "When done unzipping open: .\deep_scan.bat" is checked. (scan may take a while!)The VIPRE Rescue Program will download the files into the destination folder. Click OK at the prompt.The VIPRE Rescue Program will open a command line window and run a deep scan.When it's done, type exit and press enter to close the program.The log isn't that good but will be in the VIPRERESCUE folder and listed as a CSV file. MrC Link to post Share on other sites More sharing options...
dennisl Posted January 10, 2014 Author ID:776058 Share Posted January 10, 2014 MWB will prompt a restart after removal.Should I ignore this? Link to post Share on other sites More sharing options...
MrCharlie Posted January 10, 2014 ID:776067 Share Posted January 10, 2014 No, it's needed to complete the removal of the files. MrC Link to post Share on other sites More sharing options...
dennisl Posted January 10, 2014 Author ID:776239 Share Posted January 10, 2014 The scan completed ,but there doesn't appear to be a CSV file.MWB log attachedmbam-log-2014-01-10 (14-08-27).txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 10, 2014 ID:776262 Share Posted January 10, 2014 Did you remember if it found anything???Look in C:\ for a folder called VIPRERESCUE (C:\VIPRERESCUE)Inside the folder is the log: 20140110153614.csv <---similar to thisAttach it back here.Run another scan with Malwarebytes and see if anything shows.MrC Link to post Share on other sites More sharing options...
dennisl Posted January 11, 2014 Author ID:776727 Share Posted January 11, 2014 Just got a screen shot sent to me & I think they are showing as Excel files.I'll advise back asap Link to post Share on other sites More sharing options...
dennisl Posted January 12, 2014 Author ID:777085 Share Posted January 12, 2014 Log files attachedLook's like it's still there20140110144406.pdfmbam-log-2014-01-11 (20-43-40).txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 12, 2014 ID:777090 Share Posted January 12, 2014 That pdf log really does me no good, couldn't you just post or attach the .csv log? Download, update and run a Full scan with SUPERAntiSpyware Portable Scanner Personal Edition: http://www.superantispyware.com/portablescanner.html http://www.howtogeek.com/howto/9283/superantispyware-portable-is-the-must-have-spyware-removal-tool-you-need/ MrC Link to post Share on other sites More sharing options...
dennisl Posted January 12, 2014 Author ID:777092 Share Posted January 12, 2014 The site said I didn't have permission to upload this type of file Link to post Share on other sites More sharing options...
MrCharlie Posted January 12, 2014 ID:777102 Share Posted January 12, 2014 You can zip it up and then attach it. MrC Link to post Share on other sites More sharing options...
dennisl Posted January 13, 2014 Author ID:777312 Share Posted January 13, 2014 Please see attached20140110144406.zip Link to post Share on other sites More sharing options...
dennisl Posted January 13, 2014 Author ID:777317 Share Posted January 13, 2014 Just ran another MWB scanNow showing also showing as Memory Process. Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.orgDatabase version: v2014.01.10.04Windows 7 Service Pack 1 x86 NTFSInternet Explorer 11.0.9600.16476xxx :NB01 [administrator]13/01/2014 09:27:35MBAM-log-2014-01-13 (09-42-25).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 245419Time elapsed: 13 minute(s), 41 second(s)Memory Processes Detected: 1C:\Windows\System32\aJUFJta.exe (Trojan.Agent.ZB) -> 4844 -> No action taken.Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 1C:\Windows\System32\aJUFJta.exe (Trojan.Agent.ZB) -> No action taken. Link to post Share on other sites More sharing options...
MrCharlie Posted January 13, 2014 ID:777360 Share Posted January 13, 2014 Why aren't you having MB delete these files??? MrC Link to post Share on other sites More sharing options...
dennisl Posted January 13, 2014 Author ID:777510 Share Posted January 13, 2014 Look's promising -deleted the files & did another scan, which is showing clean.Anything else we need to do? mbam-log-2014-01-13 (17-01-44).txtmbam-log-2014-01-13 (18-21-40).txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 13, 2014 ID:777525 Share Posted January 13, 2014 Lets check your computers security before you go and we have a little cleanup to do also: Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.If you get Unsupported operating system. Aborting now, just reboot and try again.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
dennisl Posted January 14, 2014 Author ID:777762 Share Posted January 14, 2014 Scan results follow. Results of screen317's Security Check version 0.99.78 Windows 7 Service Pack 1 x86 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` SUPERAntiSpyware Malwarebytes Anti-Malware version 1.75.0.1300 Java 6 Update 29 Java 7 Update 21 Java version out of Date! Adobe Flash Player 10 Flash Player out of Date! Google Chrome 31.0.1650.57 Google Chrome 31.0.1650.63 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 1% ````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted January 14, 2014 ID:777808 Share Posted January 14, 2014 Out dated programs on the system are vulnerable to malware.Please update or uninstall them:~~~~~~~~~~~~~~~~~~~Java 7 Update 21 <------please update, should be Update 45Java version out of Date! <--------Go to control panel > Java > Update Tab > Update NowUncheck the box to install the Ask toolbar!!! and any other free "stuff".If there's no update tab in Java, uninstall it and Download and install the latest version from HereUncheck the box to install the Ask toolbar!!! and any other free "stuff".--------------------------------Adobe Flash Player 10 Flash Player out of Date! Check for an update if available~~~~~~~~~~~~~~~~~~A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)---------------------------------Please download OTC to your desktop. (This will clean up most of the tools and logs)http://oldtimer.geekstogo.com/OTC.exeDouble-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")Click on the CleanUp! button and follow the prompts.(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)You will be asked to reboot the machine to finish the Cleanup process, choose Yes.After the reboot all the tools we used should be gone.Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.Any other programs or logs you can manually delete. (right click.....Delete)IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.Note:If you used FRST and can't delete the quarantine folder:Download the fixlist.txt to the same folder as FRST.exe.Run FRST.exe and click Fix only once and waitThat will delete the quarantine folder created by FRST.The rest you can manually delete.-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
dennisl Posted January 14, 2014 Author ID:777818 Share Posted January 14, 2014 Many thanks for your assistance Dennis Link to post Share on other sites More sharing options...
MrCharlie Posted January 14, 2014 ID:777824 Share Posted January 14, 2014 OK...Take Care MrC Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 16, 2014 Root Admin ID:778825 Share Posted January 16, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts