Root Admin AdvancedSetup Posted October 10, 2014 Root Admin ID:888283 Share Posted October 10, 2014 I have to work on something else tonight so I'll check on it and reply tomorrow. Send me a PM if I've not replied within about 15 hours. Thanks Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 10, 2014 Root Admin ID:888285 Share Posted October 10, 2014 Okay I went ahead and wrote a restore script for you. Please save the attached file CFScript.txt to the same location as Combofix.exe and then quit your browser and using your mouse Drag-and-Drop the file CFScript.txt onto Combofix to run it again. Once it's completed restart your computer and let me know how things are now.CFScript.txt Link to post Share on other sites More sharing options...
ausgumbie Posted October 10, 2014 Author ID:888531 Share Posted October 10, 2014 Hi Ron Many thanks. Have just run Combofix with CFScript.txt. Just a couple of things:(1) I dragged-and dropped the script file onto Combofix and ran Combofix; BUT(2) Combofix then asked "did I want a more recent version" which I allowed (not being confident to deny it) and just let the scan proceed. I mention this as I don't know whether the update might have overwritten your script wholly or partly. I haven't repeated the drag-and-drop and re-run Combofix so the log file I attach is from the one scan. Hope I've done right cheers Howard ComboFix.txt Link to post Share on other sites More sharing options...
ausgumbie Posted October 10, 2014 Author ID:888541 Share Posted October 10, 2014 Quick addition (image) - "files still in quarantine" - cheers, H. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 11, 2014 Root Admin ID:888568 Share Posted October 11, 2014 The log shows that you did not run it with the script. Running from: c:\users\HOWARD02\Desktop\ComboFix.exe You need to drag and drop the CFScript.txt file onto combofix to run it. Link to post Share on other sites More sharing options...
ausgumbie Posted October 11, 2014 Author ID:888586 Share Posted October 11, 2014 OK - I'll give it another go. Cheers H. Link to post Share on other sites More sharing options...
ausgumbie Posted October 11, 2014 Author ID:888589 Share Posted October 11, 2014 Hi Ron I responded to your post above before reading your P.M., but fingers crossed, I've done things right this time. I dragged the CFScript.txt over Combofix (this time offline) and Combofix ran only for a very short time and produced the report below. I've checked the locations referred to in the report and the three files are, yep, now back in the "C:\Program Files (x86)\SecureW2" location with the "SecureW2\Uninstall.lnk" likewise on the "Start" programs. If this is OK so far, will I now move on to the process in your P.M.? Thanks HowardDeQuarantine.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 11, 2014 Root Admin ID:888631 Share Posted October 11, 2014 Yes, that worked fine and those files should now be back in place to use if needed. Aside from that is there anything else then before we close up here? Link to post Share on other sites More sharing options...
ausgumbie Posted October 11, 2014 Author ID:888637 Share Posted October 11, 2014 Hi Ron I gather you don't need me to do another "FRST scan log" with the DeQuarantine having worked? If not, then everything seems fine otherwise at my end. I'd just again add my sincere thanks for your help with this. Aside from fixing a problem, it's taught me a heck of a lot and so I do indeed value the time you've spent with me here! All the best, Howard Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 13, 2014 Root Admin ID:889138 Share Posted October 13, 2014 No if there are no other issues we should be done here now. At this time there are no more signs of an infection on your system.However if you are still seeing any signs of an infection please let me know.Let's go ahead and remove the tools and logs we've used during this process.Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.They are often updated daily so if you went to use them again in the future they would be outdated anyways.The following procedures will implement some cleanup procedures to remove these tools. Download Delfix from here and save it to your desktop. (you may already have this)Ensure Remove disinfection tools is checked. Click the Run button. RebootAny other programs or logs that are still remaining, you can manually delete. (right click.....Delete)IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.Note:If you used FRST and can't delete the quarantine folder:Download the fixlist.txt to the same folder as FRST.exe.Run FRST.exe and click Fix only once and waitThat will delete the quarantine folder created by FRST.The rest you can manually delete. If there are any other left over Folders, Files, Logs then you can delete them on your own. Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.How to Delete System Protection Restore Points in Windows 7 and Windows 8Remove all but the most recent Restore Point on Windows XPAs Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsersHow do I disable Java in my web browser? - Disable JavaA lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.How Malware Spreads - How did I get infected Best Practices for Safe Computing - Prevention of Malware Infection Avoiding those unwanted free applications A close look at how Oracle installs deceptive software with Java updates IAC / Ask.com toolbars Malwarebytes Unpacked BlogIf you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection. Link to post Share on other sites More sharing options...
ausgumbie Posted October 14, 2014 Author ID:889263 Share Posted October 14, 2014 No issues with the computer in general and I'll start on the cleanup below. However, over the last two days, I've noticed that it takes an inordinately long time to connect with the Malwarebytes forum, and of course this thread. (Obviously, this page has loaded now). I've also been trying to get into the message area and it just isn't loading. (i.e., the loading circle on the Firefox tab has going round and round for ages but no page.) This isn't happening with other internet connections - or the main Malwarebytes site - just the Forum site and any pages connected with it. What I'll do, unless this rings bells with you and you want to look at it here, is keep going with the cleanup as above for the issue we've been dealing with here, and maybe start a new thread with the issue of Forum "slow-loading" in case others are experiencing it. Cheers Howard / ausgumbie Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 16, 2014 Root Admin ID:890835 Share Posted October 16, 2014 Don't base the speed of our site to anything. We can be slow at times for various reasons and has nothing to do with your computer. Take care Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 16, 2014 Root Admin ID:890836 Share Posted October 16, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts