Jump to content

Fake svchost.exe (C:\Windows\Temp) - 100% CPU


Recommended Posts

Hello,

 

since yesterday, I became infected from a fake svchost.exe, which makes my CPU go to 100% soon after the PC boots.

MalwareBytes detects it everytime, but when I reboot my PC, it is there again.

(example: Detection, 01/02/2015 19:15:34, SYSTEM, MATTEO-PC, Protection, Malware Protection, File, Trojan.Agent.cn, C:\Windows\Temp\svchost.exe, Quarantine, [85c480999befd06618c320976e968878])

 

Note: not sure if related, but often MalwareBytes detects a "malicious website" via C:/SysWOW64/wscript.exe". It keeps popping every now and then.

(example: Malicious Website Protection, IP, 112.175.243.12, 1stupd.co.cc, 49559, Outbound, C:\Windows\SysWOW64\wscript.exe)

 

Attached you will find the FRST and Addition logs, along with the last MalwareBytes one.

 

Can you help me, please? Thank you in advance!

FRST.txt

Addition.txt

MBprotectionlog.txt

Link to post
Share on other sites

Just a quick update, I've removed the following:

- C:\Users\Matteo\AppData\Roaming\Origin\update.vbe (file)

- C:\Users\Matteo\AppData\Roaming\Origin\update.vbe (startup scheduled task)

 

Now, the problem seems fixed (no more svchost.exe in C:\Windows\Temp after PC startup), but MalwareBytes steel detects wscript.exe, usually 3 times in a row in a few seconds. Last time(s):

 

Detection, 01/02/2015 23:40:18, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, IP, 112.175.243.12, 49210, Outbound, C:\Windows\SysWOW64\wscript.exe, 
Detection, 01/02/2015 23:40:18, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, IP, 112.175.243.12, 49210, Outbound, C:\Windows\SysWOW64\wscript.exe, 
Detection, 01/02/2015 23:40:22, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, IP, 112.175.243.12, 49213, Outbound, C:\Windows\SysWOW64\wscript.exe, 

 

 

Link to post
Share on other sites

Thank you. I've attached the new FRST and Addition logs.

 

As I was saying, the svchost.exe problem seems gone, after deleting:

- C:\Users\Matteo\AppData\Roaming\Origin\update.vbe (file)

- C:\Users\Matteo\AppData\Roaming\Origin\update.vbe (startup scheduled task)

 

However, the wscript.exe problem is still there. Usually, MalwareBytes detect the malicious website (3 times in a row) a few minutes after Windows loads. Here's the latest detection:

 

Protection, 03/02/2015 12:16:25, SYSTEM, MATTEO-PC, Protection, Malware Protection, Starting, 
Protection, 03/02/2015 12:16:25, SYSTEM, MATTEO-PC, Protection, Malware Protection, Started, 
Protection, 03/02/2015 12:16:25, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, Starting, 
Protection, 03/02/2015 12:18:38, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, Started, 
Detection, 03/02/2015 12:21:35, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, IP, 112.175.243.12, 49215, Outbound, C:\Windows\SysWOW64\wscript.exe, 
Detection, 03/02/2015 12:21:35, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, IP, 112.175.243.12, 49215, Outbound, C:\Windows\SysWOW64\wscript.exe, 
Detection, 03/02/2015 12:21:39, SYSTEM, MATTEO-PC, Protection, Malicious Website Protection, IP, 112.175.243.12, 49217, Outbound, C:\Windows\SysWOW64\wscript.exe, 

 

 
Also, using Sysinternals Process Monitor, I see that, in fact, a few minutes after Windows boots, a TCP connection is made to 112.175.243.12.
 
Any help would be appreciated. Thank you!

FRST.txt

Addition.txt

Link to post
Share on other sites

  • Root Admin

Please visit this webpage and read the ComboFix User's Guide:

  • Once you've read the article and are ready to use the program you can download it directly from the link below.
  • Important! - Please make sure you save combofix to your desktop and do not run it from your browser
  • Direct download link for: ComboFix.exe
  • Please make sure you disable your security applications before running ComboFix.
  • Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
  • Please attach that log file to your next reply.
  • If needed the file can be located here:  C:\combofix.txt
  • NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

 

 

Link to post
Share on other sites

  • Root Admin

Great, Please go ahead and run through the following steps and post back the logs when ready.

STEP 04

Please download Junkware Removal Tool to your desktop.

  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus
STEP 05

Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.

    Vista/Windows 7/8 users right-click and select Run As Administrator

  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
STEP 06

Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link

Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkits, Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. Remove any threats found

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

STEP 07

button_eos.gif

Please go here to run the online antivirus scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
STEP 08

Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
Link to post
Share on other sites

Thank you, here are all the logs.

I've attached all of them (I tried to copy&paste them, but everything was getting too long and I was unable to post).

Maybe the problem has been found by ESET?

 

 

STEP 07 - ESET

 

C:\Program Files (x86)\Common Files\SystemEngines\out.js JS/Kryptik.AAV trojan
C:\Users\Matteo\AppData\Local\Viber\Helper.dll a variant of Win32/Toolbar.SearchSuite.P potentially unwanted application
C:\Users\Matteo\AppData\Local\Viber\Uninstall.exe a variant of Win32/Toolbar.SearchSuite.W.gen potentially unwanted application

 

 

JRT.txt

AdwCleanerS2.txt

mbam.txt

eset.txt

FRST.txt

Addition.txt

Link to post
Share on other sites

  • Root Admin

Please run the following and remove all Java. Once done cleaning if you still want to use Java we can reinstall it later but for now please remove it.

Please go into Control Panel, Add/Remove and uninstall ALL versions of Java and then run the following.

Please download JavaRa-1.16 and save it to your computer.

  • Double click to open the zip file and then select all and choose Copy.
  • Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
  • Quit all browsers and other running applications.
  • Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location and post it in your next reply.

 

Next:

Please Run TFC by OldTimer to clear temporary files:

  • Download TFC from here and save it to your desktop.
  • http://oldtimer.geekstogo.com/TFC.exe
  • Close any open programs and Internet browsers.
  • Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  • Please be patient as clearing out temp files may take a while.
  • Once it completes you may be prompted to restart your computer, please do so.
  • Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

Next,


Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Link to post
Share on other sites

Here are the JavaRa and Farbar logs.

It looks like the problem is gone, but after my PC rebooted, I got a popup error about out.js missing. Is that normal?

 

 

JavaRa

 

JavaRa 1.16 Removal Log.
 
Report follows after line.
 
------------------------------------
 
The JavaRa removal process was started on Fri Feb 06 17:01:20 2015
 
Found and removed: JavaPlugin.FamilyVersionSupport
 
Found and removed: SOFTWARE\Classes\JavaPlugin
 
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.6.0.0
 
Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
 
Found and removed: SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
 
Found and removed: SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}
 
Found and removed: SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
 
Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}
 
Found and removed: SOFTWARE\Classes\Interface\{5852F5EC-8BF4-11D4-A245-0080C6F74284}
 
Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit
 
Found and removed: SOFTWARE\Classes\TypeLib\{5852F5E0-8BF4-11D4-A245-0080C6F74284}
 
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled
 
Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.7.0.0
 
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
 
Found and removed: SOFTWARE\JavaSoft
 
Found and removed: SOFTWARE\JreMetrics
 
Found and removed: SOFTWARE\Classes\JavaPlugin.10512
 
------------------------------------
 
Finished reporting.
 

 

Farbar

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-02-2015
Ran by Matteo at 2015-02-06 17:07:57 Run:1
Running from C:\Users\Matteo\Desktop
Loaded Profiles: Matteo (Available profiles: Matteo)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
C:\Program Files (x86)\Common Files\SystemEngines\out.js
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} 
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR HomePage: Default -> hxxp://na.finalfantasyxiv.com/lodestone/
CHR StartupUrls: Default -> "hxxp://www.google.it/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
C:\Users\Matteo\AppData\Local\Temp\avgnt.exe
Task: {2CCDD930-5C6E-4F81-8270-8069B24D8C1E} - System32\Tasks\{9F72B715-C1C9-4E1D-BCDB-76533C717CCA} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/20500
Task: {3D61F61B-8FC1-4F10-8A40-07D3B0410DD9} - System32\Tasks\{8F1233A4-D50C-426D-853C-A77CDB8F773B} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{A82B049B-14E7-4E0E-946D-024AC4050EF8}\setup.exe" -c -runfromtemp -l0x0409
Task: {81B20F45-8E29-4E88-8952-A92A93737084} - System32\Tasks\{A304ABCF-CE3D-40A6-A7C9-0BAE335F846D} => pcalua.exe -a C:\Users\Matteo\Desktop\Vistumbler_v10.exe -d C:\Users\Matteo\Desktop
Task: {9BC4988F-569E-4B89-9D0A-2C30FDD0E708} - System32\Tasks\{1E3178C0-A419-46C5-9B7E-91BE2D9F27F4} => pcalua.exe -a "C:\Users\Matteo\Desktop\creo x64\setup.exe" -d "C:\Users\Matteo\Desktop\creo x64"
Task: {9F3ACD24-D341-4722-AF8F-38F2C97FB7BE} - System32\Tasks\{BB418822-3236-46D0-AF1E-E72FFE5E25EF} => pcalua.exe -a "C:\Users\Matteo\Desktop\Firefox Setup 3.6.3.exe" -d C:\Users\Matteo\Desktop
Task: {A84FD717-285C-4900-8FAD-B751BAB4F358} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-07] (Google Inc.)
Task: {BE2C03FD-A118-4267-B92F-A83580CEC899} - System32\Tasks\{1397DD0F-CD06-4312-8163-00C878B71F6C} => pcalua.exe -a C:\Users\Matteo\Desktop\jxpiinstall.exe -d C:\Users\Matteo\Desktop
Task: {C7BC5BF1-B098-4E22-8A4F-2FCB2575B566} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-07] (Google Inc.)
Task: {C7C0DE3A-DAE7-4019-A974-CAE45F8CD377} - System32\Tasks\{28FD6FA6-0D42-4E58-81E0-200C6DE507FA} => pcalua.exe -a "D:\creo x64\setup.exe" -d "D:\creo x64"
Task: {EAB98B0E-460D-4AFA-8AE6-5E84BEF2D0B9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {EB539B6E-A905-49E5-A34F-5D13E02534A1} - System32\Tasks\{0484AFD9-C1E4-4611-943C-79781EE47AF3} => pcalua.exe -a C:\Users\Matteo\AppData\Local\Apps\2.0\M49VJ2YP.0CX\NMYWK0ZM.Q98\arch..tion_2daddc9f46c5a0a2_0001.0000_d65f394dc7765e30\uninstall.exe -c uninstall
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
AlternateDataStreams: C:\ProgramData\TEMP:2BE9FEFC
AlternateDataStreams: C:\ProgramData\TEMP:661DFA1C
AlternateDataStreams: C:\ProgramData\TEMP:6724CB45
AlternateDataStreams: C:\ProgramData\TEMP:B3FF5095
AlternateDataStreams: C:\Users\Matteo\Cookies:6qjbezkojbUVE1uz6cnTUZVHAf
AlternateDataStreams: C:\Users\Matteo\Impostazioni locali:l1ewLQaUrDybmSbvFcHk9Ta2
AlternateDataStreams: C:\Users\Matteo\AppData\Local:l1ewLQaUrDybmSbvFcHk9Ta2
AlternateDataStreams: C:\Users\Matteo\AppData\Local\Dati applicazioni:l1ewLQaUrDybmSbvFcHk9Ta2
AlternateDataStreams: C:\Users\Matteo\AppData\Local\Temporary Internet Files:jpViMy8E2zYtHbUWPS5kPZZgyB
AlternateDataStreams: C:\Users\Matteo\AppData\Local\Temporary Internet Files:P8O0vB02sH9jcxdLREt
EmptyTemp:
Reboot:
 
*****************
 
C:\Program Files (x86)\Common Files\SystemEngines\out.js => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Search Page => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page => value deleted successfully.
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully.
"HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
"HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found. 
HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found. 
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key not found. 
HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} => Key not found. 
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" => Key deleted successfully.
HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.31.2 => Key not found. 
"C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll" => not found.
HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2 => Key not found. 
"C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll" => not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.31.2 => Key not found. 
C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2 => Key not found. 
C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll not found.
Chrome HomePage deleted successfully.
Chrome StartupUrls deleted successfully.
Chrome DefaultSuggestURL deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk" => Key deleted successfully.
C:\Users\Matteo\AppData\Local\Temp\avgnt.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2CCDD930-5C6E-4F81-8270-8069B24D8C1E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2CCDD930-5C6E-4F81-8270-8069B24D8C1E}" => Key deleted successfully.
C:\Windows\System32\Tasks\{9F72B715-C1C9-4E1D-BCDB-76533C717CCA} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9F72B715-C1C9-4E1D-BCDB-76533C717CCA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3D61F61B-8FC1-4F10-8A40-07D3B0410DD9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D61F61B-8FC1-4F10-8A40-07D3B0410DD9}" => Key deleted successfully.
C:\Windows\System32\Tasks\{8F1233A4-D50C-426D-853C-A77CDB8F773B} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8F1233A4-D50C-426D-853C-A77CDB8F773B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{81B20F45-8E29-4E88-8952-A92A93737084}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81B20F45-8E29-4E88-8952-A92A93737084}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A304ABCF-CE3D-40A6-A7C9-0BAE335F846D} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A304ABCF-CE3D-40A6-A7C9-0BAE335F846D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9BC4988F-569E-4B89-9D0A-2C30FDD0E708}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9BC4988F-569E-4B89-9D0A-2C30FDD0E708}" => Key deleted successfully.
C:\Windows\System32\Tasks\{1E3178C0-A419-46C5-9B7E-91BE2D9F27F4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1E3178C0-A419-46C5-9B7E-91BE2D9F27F4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9F3ACD24-D341-4722-AF8F-38F2C97FB7BE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F3ACD24-D341-4722-AF8F-38F2C97FB7BE}" => Key deleted successfully.
C:\Windows\System32\Tasks\{BB418822-3236-46D0-AF1E-E72FFE5E25EF} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BB418822-3236-46D0-AF1E-E72FFE5E25EF}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A84FD717-285C-4900-8FAD-B751BAB4F358}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A84FD717-285C-4900-8FAD-B751BAB4F358}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BE2C03FD-A118-4267-B92F-A83580CEC899}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BE2C03FD-A118-4267-B92F-A83580CEC899}" => Key deleted successfully.
C:\Windows\System32\Tasks\{1397DD0F-CD06-4312-8163-00C878B71F6C} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1397DD0F-CD06-4312-8163-00C878B71F6C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C7BC5BF1-B098-4E22-8A4F-2FCB2575B566}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7BC5BF1-B098-4E22-8A4F-2FCB2575B566}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C7C0DE3A-DAE7-4019-A974-CAE45F8CD377}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7C0DE3A-DAE7-4019-A974-CAE45F8CD377}" => Key deleted successfully.
C:\Windows\System32\Tasks\{28FD6FA6-0D42-4E58-81E0-200C6DE507FA} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{28FD6FA6-0D42-4E58-81E0-200C6DE507FA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EAB98B0E-460D-4AFA-8AE6-5E84BEF2D0B9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EAB98B0E-460D-4AFA-8AE6-5E84BEF2D0B9}" => Key deleted successfully.
C:\Windows\System32\Tasks\Apple\AppleSoftwareUpdate => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Apple\AppleSoftwareUpdate" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EB539B6E-A905-49E5-A34F-5D13E02534A1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB539B6E-A905-49E5-A34F-5D13E02534A1}" => Key deleted successfully.
C:\Windows\System32\Tasks\{0484AFD9-C1E4-4611-943C-79781EE47AF3} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0484AFD9-C1E4-4611-943C-79781EE47AF3}" => Key deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\ProgramData\TEMP => ":2BE9FEFC" ADS removed successfully.
C:\ProgramData\TEMP => ":661DFA1C" ADS removed successfully.
C:\ProgramData\TEMP => ":6724CB45" ADS removed successfully.
C:\ProgramData\TEMP => ":B3FF5095" ADS removed successfully.
"C:\Users\Matteo\Cookies" => ":6qjbezkojbUVE1uz6cnTUZVHAf" ADS not found.
"C:\Users\Matteo\Impostazioni locali" => ":l1ewLQaUrDybmSbvFcHk9Ta2" ADS not found.
C:\Users\Matteo\AppData\Local => ":l1ewLQaUrDybmSbvFcHk9Ta2" ADS removed successfully.
"C:\Users\Matteo\AppData\Local\Dati applicazioni" => ":l1ewLQaUrDybmSbvFcHk9Ta2" ADS not found.
"C:\Users\Matteo\AppData\Local\Temporary Internet Files" => ":jpViMy8E2zYtHbUWPS5kPZZgyB" ADS not found.
"C:\Users\Matteo\AppData\Local\Temporary Internet Files" => ":P8O0vB02sH9jcxdLREt" ADS not found.
EmptyTemp: => Removed 467.9 MB temporary data.
 
 
The system needed a reboot. 
 
==== End of Fixlog 17:08:21 ====

JavaRa.log

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

Please do the following and we'll check on other errors.

 

Please visit each of the following sites and lets reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Firefox
Click on Help / Troubleshooting Information then click on the Reset Firefox button.

Chrome
Start by disabling Sync
How To Delete Your Google Chrome Browser Sync Data
Chrome - Reset browser settings
If that fails then Uninstall Google Chrome and do not reinstall until sure the system is clean.
 

 

Next,

Please download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!


 

 

Next,

 

Please restart the computer again and run a new FRST scan and make sure you place a check mark in the Addition.txt check box and post back both new logs

Link to post
Share on other sites

Done, here are the new logs. Checkup.txt copy&paste'd as requested.

Note: I still haven't reinstalled Java, however, for some reason, it is listed. Also, Google Chrome is actually up-to-date.

 

 

Security Check - checkup.txt

 

 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 MVPS Hosts File  
 Spybot - Search & Destroy 
  Java 64-bit 8 Update 31
 Adobe Flash Player 16.0.0.305  
 Adobe Reader 9  
 Adobe Reader XI  
 Mozilla Firefox (35.0.1) 
 Google Chrome 39.0.2171.71 Google Chrome out of date!
````````Process Check: objlist.exe by Laurent````````
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0% 
````````````````````End of Log``````````````````````

FRST.txt

Addition.txt

Link to post
Share on other sites

  • Root Admin

The logs look pretty good now. I would not worry about the entry there for Java. That's part of the issue with Java as it's so strewn out all over the file system and the registry it's pretty difficult to remove all traces of it.

 

How is the computer running now?

Are there still any signs of an infection?

 

Please read the following article cocerning the use of MSCONFIG
Msconfig Is Not A Startup Manager
 

Link to post
Share on other sites

  • Root Admin

Please reset MSCONFIG back to NORMAL and reboot the computer.

 

Then restart one more time and run a new FRST scan and make sure you place a check mark in the Addition.txt check box and post back the new logs and we'll take a looks see what might be causing that.

Link to post
Share on other sites

  • Root Admin

Create an Autoruns Log:

  • Please download Sysinternals Autoruns from here.
  • Save Autoruns.exe to your desktop and double-click it to run it.
  • Once it starts, please press the Esc key on your keyboard.
  • Now that scanning is stopped, click on the Options button at the top of the program and select Verify Code Signatures
  • Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
  • When it's finished, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.
  • Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
  • Attach the Autoruns.zip folder you just created to your next reply

Link to post
Share on other sites

  • Root Admin

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.
 

fixlist.txt

Link to post
Share on other sites

Great, the out.js problem is gone :) Fixlog attached.

Regarding startup management: is it ok if I still use CCleaner, or should I use Autoruns? Thank you.

 

 

Fixlog

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2015
Ran by Matteo at 2015-02-08 14:49:20 Run:2
Running from C:\Users\Matteo\Desktop
Loaded Profiles: Matteo (Available profiles: Matteo)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
HKLM-x32\...\Run: [sunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM-x32\...\Run: [sysEng] => wscript.exe "C:\Program Files (x86)\Common Files\SystemEngines\out.js"
HKLM-x32\...\Run: [iSUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\...\Run: [iSUSPM Startup] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\...\Run: [cacaoweb] => "C:\Users\Matteo\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer
C:\Users\Matteo\AppData\Roaming\cacaoweb\
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-01-30]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-01-30]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2015-01-30]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-30]
U3 alwlgxlp; C:\Windows\System32\Drivers\alwlgxlp.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)
C:\Users\Matteo\AppData\Local\Temp\cpuz130
S3 cpuz130; \??\C:\Users\Matteo\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
Task: {05303341-5371-48E3-ADC9-657B06DC0413} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-07] (Google Inc.)
Task: {8145BA0D-33BF-4207-B5BF-4BF8052F7EA3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-07] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
AlternateDataStreams: C:\ProgramData\TEMP:2BE9FEFC
AlternateDataStreams: C:\Users\Matteo\Cookies:6qjbezkojbUVE1uz6cnTUZVHAf
AlternateDataStreams: C:\Users\Matteo\AppData\Local\Temporary Internet Files:jpViMy8E2zYtHbUWPS5kPZZgyB
AlternateDataStreams: C:\Users\Matteo\AppData\Local\Temporary Internet Files:P8O0vB02sH9jcxdLREt
EmptyTemp:
Reboot:
 
*****************
 
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SysEng => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ISUSScheduler => value deleted successfully.
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ISUSPM Startup => value deleted successfully.
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster => value deleted successfully.
HKU\S-1-5-21-3237753715-2783626874-1518741198-1000\Software\Microsoft\Windows\CurrentVersion\Run\\cacaoweb => value deleted successfully.
"C:\Users\Matteo\AppData\Roaming\cacaoweb" => File/Directory not found.
"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi => Moved successfully.
alwlgxlp => Service not found.
"C:\Users\Matteo\AppData\Local\Temp\cpuz130" => File/Directory not found.
cpuz130 => Service deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{05303341-5371-48E3-ADC9-657B06DC0413}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{05303341-5371-48E3-ADC9-657B06DC0413}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8145BA0D-33BF-4207-B5BF-4BF8052F7EA3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8145BA0D-33BF-4207-B5BF-4BF8052F7EA3}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => Key deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\ProgramData\TEMP => ":2BE9FEFC" ADS removed successfully.
"C:\Users\Matteo\Cookies" => ":6qjbezkojbUVE1uz6cnTUZVHAf" ADS not found.
"C:\Users\Matteo\AppData\Local\Temporary Internet Files" => ":jpViMy8E2zYtHbUWPS5kPZZgyB" ADS not found.
"C:\Users\Matteo\AppData\Local\Temporary Internet Files" => ":P8O0vB02sH9jcxdLREt" ADS not found.
EmptyTemp: => Removed 530.1 MB temporary data.
 
 
The system needed a reboot. 
 
==== End of Fixlog 14:49:51 ====
Link to post
Share on other sites

  • Root Admin

You can use ccleaner. Just saying one should not use MSCONFIG as one. Though if you're really not using the software I'd recommend uninstalling it where possible or if it's an entry for startup that you don't ever want then simply delete the entry and don't use anything to "manage it", but that's up to you.

 

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.
 
bwebb7v.jpgDownload Delfix from here and save it to your desktop. (you may already have this)

  • Ensure Remove disinfection tools is checked.
  • Click the Run button.
  • Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.
 
 
If there are any other left over Folders, Files, Logs then you can delete them on your own.
 
Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP


As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.


If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.
 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.