also @ TechSpot: Onion Pi transforms Raspberry Pi into anonymous Wi-Fi hotspot

EasyBits malware

Discussion in 'Virus and Malware Removal' started by hokokhua, Nov 28, 2012.

Page 2 of 2

  1. hokokhua Newcomer, in training Posts: 40

    All processes killed
    ========== FILES ==========
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\MLS folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games\EB659AD2FCC647F38E82982293E1663C folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games\C7D94334204347AEBB0F776ED21C7F29 folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games\C5094D21049946CC8CCB397AAB28817A folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games\ABC0C93967AD43098E0382FD5EA9DFE1\fight folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games\ABC0C93967AD43098E0382FD5EA9DFE1 folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games\7FF10FD1D9E1467181402A0155363CB2 folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games\Games folder moved successfully.
    C:\Program Files\WIDCOMM\Bluetooth Software\EasyBits Games folder moved successfully.
    ========== REGISTRY ==========
    Registry key HKEY_CURRENT_USER\Software\EasyBits\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{285417A7-D46C-4E79-AEB7-990F807FEC76}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{285417A7-D46C-4E79-AEB7-990F807FEC76}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D07B6E4-681E-436A-9471-CEDD4FFF4BDA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D07B6E4-681E-436A-9471-CEDD4FFF4BDA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A2D99BA-A1DD-4841-93F7-89B43D089B87}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7A2D99BA-A1DD-4841-93F7-89B43D089B87}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{95105DA3-7251-4CD4-83D8-00253EC1CF71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95105DA3-7251-4CD4-83D8-00253EC1CF71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFF50E68-96C2-4CF9-B73F-817CA253EF7F}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFF50E68-96C2-4CF9-B73F-817CA253EF7F}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C057D776-076E-4C22-A33F-20242B43AC0A}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C057D776-076E-4C22-A33F-20242B43AC0A}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{285417A7-D46C-4E79-AEB7-990F807FEC76}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{285417A7-D46C-4E79-AEB7-990F807FEC76}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{2A64B37D-6771-4868-A0C2-4A634F24DCF8}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2A64B37D-6771-4868-A0C2-4A634F24DCF8}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{4B750581-9399-4982-9DE9-9FF5C980C4B6}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B750581-9399-4982-9DE9-9FF5C980C4B6}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{6CE9D2AD-2714-40F4-9D4B-837C4F52D19D}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6CE9D2AD-2714-40F4-9D4B-837C4F52D19D}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{7B94B64E-BA5D-497E-B46D-E455C52F95FA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7B94B64E-BA5D-497E-B46D-E455C52F95FA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{D01F4D0F-D9EA-4E14-9DFF-EF04FB915943}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D01F4D0F-D9EA-4E14-9DFF-EF04FB915943}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders not found.
    Registry key HKEY_USERS\S-1-5-21-3892454325-3400438884-1050192996-1000\Software\EasyBits\ not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: PlayOnHD
    ->Temp folder emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: user
    ->Temp folder emptied: 133281 bytes
    ->Temporary Internet Files folder emptied: 23939944 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Google Chrome cache emptied: 274144710 bytes
    ->Flash cache emptied: 1308 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 4726 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 2357746 bytes

    Total Files Cleaned = 287.00 mb


    OTL by OldTimer - Version 3.2.69.0 log created on 12042012_090347
    Files\Folders moved on Reboot...
    C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    PendingFileRenameOperations files...
    Registry entries deleted on Reboot...
    hokokhua, Dec 3, 2012
    #21

  2. hokokhua Newcomer, in training Posts: 40

    Hey DMJ,
    Thanks! The Easybit files are gone. Incidentally, are you able to tell how I got infected so I'd more carefully in future.

    Paul
    hokokhua, Dec 3, 2012
    #22

  3. Jay Pfoutz Malware Helper Posts: 4,286   +49

    You had some adware, which can happen through a variety of events. Mostly, adware gets installed by first installing other programs, then the adware was attached. Usually this happens when you use download sites, off-sites for the specific download, or actually downloading adware itself (unsuspectingly).

    I'd be happy to give recommendations, but we need to finish up first and I need info from Security Check tool, so I can help your computer get protected, as well. :)

    Clean up System Restore

    Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

    To manually create a new Restore Point
    • Go to Control Panel and select System and Maintenance
    • Select System
    • On the left select Advance System Settings and accept the warning if you get one
    • Select System Protection Tab
    • Select Create at the bottom
    • Type in a name I.e. Clean
    • Select Create
    Now we can purge the infected ones
    • Go back to the System and Maintenance page
    • Select Performance Information and Tools
    • On the left select Open Disk Cleanup
    • Select Files from all users and accept the warning if you get one
    • In the drop down box select your main drive I.e. C
    • For a few moments the system will make some calculations:
      [IMG]
    • Select the More Options tab
      [IMG]
    • In the System Restore and Shadow Backups select Clean up
      [IMG]
    • Select Delete on the pop up
    • Select OK
    • Select Delete
    Run OTC to remove our tools

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC.exe by OldTimer:
    • Save it to your Desktop.
    • Double click OTC.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note:If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

    Purge old temporary files

    NOTE: If you already have this installed, you don't have to reinstall it.

    Please download CCleaner Slim and save it to your Desktop - Alternate download link

    When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
    Follow the prompts to install the program.

    • Double-click the CCleaner shortcut on the desktop to start the program.
    • A prompt will ask you if you want CCleaner to do a check to see what cookies it needs to keep. Allow that operation.
    • On the Cleaner tab, click on Run Cleaner on the bottom-right to run the program.
    • Important: Make sure that ALL browser windows are closed before selecting Run Cleaner, or it will ask if you want the program to close them for you (when you do this, all unsaved data may be lost in the browser).

    Caution: Only use the Registry feature if you are very familiar with the registry.
    Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

    Security Check

    Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    Jay Pfoutz, Dec 4, 2012
    #23

  4. hokokhua Newcomer, in training Posts: 40

    Results of screen317's Security Check version 0.99.56
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 9
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    ESET Smart Security 5.0
    Antivirus up to date!
    `````````Anti-malware/Other Utilities Check:`````````
    Malwarebytes Anti-Malware version 1.65.1.1000
    JavaFX 2.1.1
    Java(TM) 7 Update 5
    Java version out of Date!
    Adobe Flash Player 11.5.502.110
    Adobe Reader 10.1.4 Adobe Reader out of Date!
    Mozilla Firefox 16.0.2 Firefox out of Date!
    Google Chrome 21.0.1180.83
    Google Chrome 21.0.1180.89
    Google Chrome 22.0.1229.79
    Google Chrome 22.0.1229.92
    Google Chrome 22.0.1229.94
    Google Chrome 23.0.1271.64
    Google Chrome 23.0.1271.91
    Google Chrome 23.0.1271.95
    ````````Process Check: objlist.exe by Laurent````````
    ESET NOD32 Antivirus egui.exe
    ESET NOD32 Antivirus ekrn.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: 0%
    ````````````````````End of Log``````````````````````
    hokokhua, Dec 5, 2012
    #24

  5. Jay Pfoutz Malware Helper Posts: 4,286   +49

    Java Update!

    Please download the newest version of Java from Java.com.

    Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
    Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
    Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

    Once old versions are gone, please install the newest version.

    Read more about Java exploit problems


    Adobe Reader Update!

    Please download the newest version of Adobe Acrobat Reader from Adobe.com

    Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
    Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
    Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

    Once old versions are gone, please install the newest version.



    Firefox update

    Firefox is out of date. Firefox is a very popular web browser, and if it is out of date, it is very vulnerable to security bugs, and other holes. To update it now, click Help > About Firefox > Check for Updates.


    Personal Tips on Preventing Malware

    See this page for more info about malware and prevention.


    Any other questions before I mark this topic solved?
    Jay Pfoutz, Dec 5, 2012
    #25

  6. hokokhua Newcomer, in training Posts: 40

    Hey DMJ, I think I'm fine now. Thanks!!
    hokokhua, Dec 5, 2012
    #26
     

  7. Jay Pfoutz Malware Helper Posts: 4,286   +49

    Awesome!

    Topic solved. :D
    Jay Pfoutz, Dec 5, 2012
    #27
Page 2 of 2
Topic Status:
Not open for further replies.

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...

Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.