also @ TechSpot: Android 4.0: Tracking Ice Cream Sandwich's Availability on Smartphones

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Solved] Yet another 'Clusters are partly damaged' virus. Pls help

Discussion in 'Virus and Malware Removal' started by sweetjasmin25, Dec 20, 2011.

Page 2 of 2

  1. Broni Malware Annihilator

    Explain please.
    Broni, Dec 22, 2011
    #21

  2. sweetjasmin25 Newcomer, in training

    In c:/users/public/documents i have 3 folders (my music, my pictures, my videos) that are password protected. i did not have any such files on my computer prior. when trying to open them, i get a pop-up saying 'Access is denied.'
    sweetjasmin25, Dec 22, 2011
    #22

  3. Broni Malware Annihilator

    You said something about some icons missing. What are those?

    As for those folders....

    Lets run the following tool. This will help determine which files need permissions restored.

    Please download and save Junction.zip

    Unzip it and place Junction.exe in the Windows directory (C:\Windows).
    Go to Start>Run (Vista and Windows 7 users use "Start search" box).
    Copy and paste the following command in the Run box and click OK (Vista and Windows 7 users press "Enter"):

    cmd /c junction -s c:\ >log.txt&log.txt& del log.txt

    A command window opens starting to scan the system.
    Wait until a log file opens.
    Copy and paste the log in your next reply.
    Broni, Dec 22, 2011
    #23

  4. sweetjasmin25 Newcomer, in training

    New OTL log:

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\Windows\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Flash cache emptied: 56502 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Miruna
    ->Temp folder emptied: 158495 bytes
    ->Temporary Internet Files folder emptied: 140805357 bytes
    ->Java cache emptied: 27229722 bytes
    ->FireFox cache emptied: 51469442 bytes
    ->Flash cache emptied: 192910 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 34947 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67429 bytes
    RecycleBin emptied: 41565 bytes

    Total Files Cleaned = 210.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Miruna
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 12222011_120020

    Files\Folders moved on Reboot...
    C:\Users\Miruna\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...
    sweetjasmin25, Dec 22, 2011
    #24

  5. sweetjasmin25 Newcomer, in training

    The Security Check Log:

    Results of screen317's Security Check version 0.99.24
    Windows 7 x64 (UAC is disabled!)
    Internet Explorer 9
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 26
    Out of date Java installed!
    Adobe Flash Player ( 10.0.42.34) Flash Player Out of Date!
    Mozilla Firefox (3.5.9) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Malwarebytes' Anti-Malware mbamservice.exe
    Malwarebytes' Anti-Malware mbamgui.exe
    Trend Micro AMSP coreServiceShell.exe
    Trend Micro UniClient UiFrmWrk uiWatchDog.exe
    Trend Micro AMSP coreFrameworkHost.exe
    Trend Micro UniClient UiFrmWrk uiSeAgnt.exe
    ``````````End of Log````````````



    !!!Note: I updated Java, but I had no idea how to UNCHECK any pre-checked toolbar and/or software offered with the Java update. And I couldn't find JQS on my computer.
    sweetjasmin25, Dec 22, 2011
    #25

  6. sweetjasmin25 Newcomer, in training

    Eset din not found any threats.
    sweetjasmin25, Dec 22, 2011
    #26

  7. Broni Malware Annihilator

    Broni, Dec 22, 2011
    #27

  8. sweetjasmin25 Newcomer, in training

    Okay,

    I updated Adobe. I unzipped and ran Junction.exe again. It ... flashes a pop-up window (black background with a few lines) that looks like a log. It literally pops for 2 seconds then it disappeares. I then go to Start - search - paste the command you said to, and it pops the .txt log file blank, and another window with a black background that reads what i told you. I'm not sure where the problem is.

    As for the icons, I was reffering to the shortcuts/files saved on my desktop, the only two missing, as far as I can tell right now, are Internet Explorer and Firefox.
    sweetjasmin25, Dec 22, 2011
    #28

  9. Broni Malware Annihilator

    You can easily create new shortcuts.

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
    Broni, Dec 22, 2011
    #29

  10. sweetjasmin25 Newcomer, in training

    I certainly can, I got a bit scared because the desktop looked a bit too bare, I guess :)

    The new OTL log:

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Miruna
    ->Temp folder emptied: 491189 bytes
    ->Temporary Internet Files folder emptied: 74478224 bytes
    ->Java cache emptied: 488 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 1629 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 26673 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 79951 bytes

    Total Files Cleaned = 72.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Miruna
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb

    Restore point Set: OTL Restore Point

    OTL by OldTimer - Version 3.2.31.0 log created on 12222011_230619

    Files\Folders moved on Reboot...
    C:\Users\Miruna\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...
    sweetjasmin25, Dec 22, 2011
    #30

  11. Broni Malware Annihilator

    Way to go!! [IMG]
    Good luck and stay safe :)
    Broni, Dec 22, 2011
    #31

  12. sweetjasmin25 Newcomer, in training

    I can't begin to thank you enough. If you could please bare with me for some last advices, I'll so appreciate it...

    I'm currently using Trend Micro Titanium. Sould I keep it and be more careful in the future, or should I purchase another AV?

    How can I make sure I get the newest Windows Updates?

    Thank you!!!!
    sweetjasmin25, Dec 22, 2011
    #32

  13. Broni Malware Annihilator

    You're very welcome [IMG]

    There is no perfect security program.
    If you read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html you'll know what really matters - your computing habits.

    As for Windows updates...go Start>All Programs click on Windows Updates.
    It'll tell you.
    Broni, Dec 22, 2011
    #33

  14. sweetjasmin25 Newcomer, in training

    Awesome, will do! Thank you again!
    sweetjasmin25, Dec 22, 2011
    #34

  15. Broni Malware Annihilator

    :)...................
    Broni, Dec 22, 2011
    #35
Page 2 of 2