Blind Dragon
Posts: 3,774 +4
Once the program has loaded, select Perform full scan, then click Scan.
Be sure that everything is checked, and click Remove Selected.
Be sure that everything is checked, and click Remove Selected.
Infected Computer Need Help
- Thread starter CannonComp
- Start date
- Status
CannonComp
Posts: 23 +0
here are the logs and i will do a full scan now
Blind Dragon
Posts: 3,774 +4
Ok, I will post further instructions after seeing that log
CannonComp
Posts: 23 +0
Malwarebytes' Anti-Malware 1.10
Database version: 589
Scan type: Full Scan (C:\|)
Objects scanned: 200077
Time elapsed: 48 minute(s), 1 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Deckard\System Scanner\20080403074409\backup\Users\Peter\AppData\Local\Temp\emfcvhrd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\20080403074409\backup\Users\Peter\AppData\Local\Temp\iflaoeha.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\20080403074409\backup\Users\Peter\AppData\Local\Temp\ygatvrbj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Database version: 589
Scan type: Full Scan (C:\|)
Objects scanned: 200077
Time elapsed: 48 minute(s), 1 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Deckard\System Scanner\20080403074409\backup\Users\Peter\AppData\Local\Temp\emfcvhrd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\20080403074409\backup\Users\Peter\AppData\Local\Temp\iflaoeha.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Deckard\System Scanner\20080403074409\backup\Users\Peter\AppData\Local\Temp\ygatvrbj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Blind Dragon
Posts: 3,774 +4
Good, looks like that got the rest of Vundo off.
Update your Java Runtime Environment
Download and Run ATF Cleaner
Download ATF Cleaner by Atribune to your desktop.
Double-click ATF Cleaner.exe to open it.
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox or Opera:
Click Firefox or Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Run Kaspersky Online AV Scanner
Order to use it you have to use Internet Explorer.
Go to Kaspersky and click the Accept button at the end of the page.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
Update your Java Runtime Environment
- First try going to Start -> Control Panel -> double click Java
- Select the Update Tab at the top of the Java console
- Click the Check for Updates button at the bottom
- If it finds the newer version (Java 6 Update 5) Follow the on screen instructions
- After it installs the newest version Go back to Control Panel -> Add/remove programs
- Uninstall any older versions of Java
Download and Run ATF Cleaner
Download ATF Cleaner by Atribune to your desktop.
Double-click ATF Cleaner.exe to open it.
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox or Opera:
Click Firefox or Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Run Kaspersky Online AV Scanner
Order to use it you have to use Internet Explorer.
Go to Kaspersky and click the Accept button at the end of the page.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
- Read the Requirements and limitations before you click Accept.
- Allow the ActiveX download if necessary.
- Once the database has downloaded, click Next.
- Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK.
- Click on "My Computer"
- When the scan has completed, click Save Report As...
- Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
- Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
CannonComp
Posts: 23 +0
Here is the log sorry it took so long but i scanned it wrong the first time and i did it only for my main drive as i am positive that there is nothing on my second drive
CannonComp
Posts: 23 +0
in that log it showed the Fraps file as something weird so i tried this
---------------------------------------------------------
AVG Anti-Spyware - Fileshredder Report
---------------------------------------------------------
+ Created at: 21:52:16 04/04/2008
+ Shredder Level: Paranoid Mode [ Level 3 ]
+ Fileslist:
3.15 MB C:\Users\Peter\Downloads\Fraps 2.9.4 Fully registered\fraps_2.9.4.EXE File shredded
99 bytes C:\Users\Peter\Downloads\Fraps 2.9.4 Fully registered\Please read me.txt File shredded
::Report end
---------------------------------------------------------
AVG Anti-Spyware - Fileshredder Report
---------------------------------------------------------
+ Created at: 21:52:16 04/04/2008
+ Shredder Level: Paranoid Mode [ Level 3 ]
+ Fileslist:
3.15 MB C:\Users\Peter\Downloads\Fraps 2.9.4 Fully registered\fraps_2.9.4.EXE File shredded
99 bytes C:\Users\Peter\Downloads\Fraps 2.9.4 Fully registered\Please read me.txt File shredded
::Report end
Blind Dragon
Posts: 3,774 +4
You must have got a bad download
First of all -> go to control panel -> add/remove programs:
Uninstall Fraps 2.9.4 if there
----------------------------------------------------------------------------------
Please download VundoFix.exe to your desktop.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
---------------------------------------------------------------------------------------------
Also I didn't see a firewall, do you have one included with Mcafee?
Also let me see a fresh Hijackthis after the above has been done.
You are almost there
First of all -> go to control panel -> add/remove programs:
Uninstall Fraps 2.9.4 if there
----------------------------------------------------------------------------------
Please download VundoFix.exe to your desktop.
- Double-click VundoFix.exe to run it.
- Click the Scan for Vundo button.
- Once it's done scanning, click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will reboot your computer, click OK.
- Please post the contents of C:\vundofix.txt and a new HiJackThis log.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
---------------------------------------------------------------------------------------------
Also I didn't see a firewall, do you have one included with Mcafee?
Also let me see a fresh Hijackthis after the above has been done.
You are almost there
CannonComp
Posts: 23 +0
of first thing i had already uninstalled fraps but i think cos it had the virus in it it wasnt got fid of so i used the AVG Shredder tool to permantly get rif of those files (thats what the other log is)
Next i was using Microsoft firewall temorarily i have changed back now though
Just doing VundoFix and HJT now i will put it on in about 5-10 mins
Next i was using Microsoft firewall temorarily i have changed back now though
Just doing VundoFix and HJT now i will put it on in about 5-10 mins
Blind Dragon
Posts: 3,774 +4
Ok thanks. How is your computer running? Any symptoms?
Logs are looking better
Logs are looking better
CannonComp
Posts: 23 +0
running slightly better and also i managed to get my desktop back i think that that is because control panel is working better
i think that i will have to run it for a day after i got rid of the virus to be sure though
i think that i will have to run it for a day after i got rid of the virus to be sure though
CannonComp
Posts: 23 +0
Ok good news VundoFix didnt show anything
heres HJT log
GTG now so if u post i will not reply until tommorow
heres HJT log
GTG now so if u post i will not reply until tommorow
Blind Dragon
Posts: 3,774 +4
Update your Java Runtime Environment
If for some reason you couldn't update through the above instructions.
Uninstall Combofix
* Click START then RUN
* Now type Combofix /u in the runbox
* Make sure there's a space between Combofix and /u
* Then hit Enter.
* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
-----------------------------------------------------------------------
Cleanup using OTMoveit2 by OldTimer
Now we can clear out the rest of the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally.
Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop.
1. Double click OTMoveIt2.exe to launch it.
If using Vista Right-Click OTMoveIt and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
* When finished exit out of OTMoveIt2
---------------------------------------------------------------------------
I recommend you keep
1 anti virus program
1 firewall
Combo of Anti-Spyware (Spybot S&D and MBAM, or your choice)
For Spybot you can download the latest version from HERE.
keep them updated.
You can also turn on tea timer in Spybot:
Also under Tools you can double-click System Startup in the right pane and disable programs from running at startup. This will free up system resources. For example if you don't use MSN Messenger everytime you run your computer you can disable it, then when you want to use it you can launch it through Start -> all programs, or make a shortcut on the desktop for it. That way it doesn't use resources when you aren't using it. Don't disable any entries in green though.
And just to be sure
Set correct settings for files
clear system restore points
- First try going to Start -> Control Panel -> double click Java
- Select the Update Tab at the top of the Java console
- Click the Check for Updates button at the bottom
- If it finds the newer version (Java 6 Update 5) Follow the on screen instructions
- After it installs the newest version Go back to Control Panel -> Add/remove programs
- Uninstall any older versions of Java
If for some reason you couldn't update through the above instructions.
- Click the following link
Java Runtime Environment 6 Update 5 - The 4th option down is the one you want (click Download)
- Check the box to agree to terms of service
- Check the box for your operating system and click 'Download selected'at the bottom
- After the install Go to Start-> Control Panel-> add/remove programs (Programs and features), and uninstall any old versions
- Navigate to C:\programfiles\Java -> delete any subfolders except the jre1.6.0_05 folder
Uninstall Combofix
* Click START then RUN
* Now type Combofix /u in the runbox
* Make sure there's a space between Combofix and /u
* Then hit Enter.
* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
-----------------------------------------------------------------------
Cleanup using OTMoveit2 by OldTimer
Now we can clear out the rest of the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally.
Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop.
1. Double click OTMoveIt2.exe to launch it.
If using Vista Right-Click OTMoveIt and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
* When finished exit out of OTMoveIt2
---------------------------------------------------------------------------
I recommend you keep
1 anti virus program
1 firewall
Combo of Anti-Spyware (Spybot S&D and MBAM, or your choice)
For Spybot you can download the latest version from HERE.
keep them updated.
You can also turn on tea timer in Spybot:
- Click on Mode at the top and make sure that Advanced is checked
- Expand the Tools tab in the left pane
- Single click on the Resident Icon also in the left pane
- check Resident "TeaTimer" (Protection of over-all system settings) Active
- Close spybot
Also under Tools you can double-click System Startup in the right pane and disable programs from running at startup. This will free up system resources. For example if you don't use MSN Messenger everytime you run your computer you can disable it, then when you want to use it you can launch it through Start -> all programs, or make a shortcut on the desktop for it. That way it doesn't use resources when you aren't using it. Don't disable any entries in green though.
And just to be sure
Set correct settings for files
- Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
- Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
- If unchecked please check Hide protected operating system files (Recommended)
- If necessary check "Display content of system folders"
- If necessary Uncheck Hide file extensions for known file types.
- Click OK
clear system restore points
This is a good time to clear your existing system restore points and establish a new clean restore point:- Go to Start > All Programs > Accessories > System Tools > System Restore
- Select Create a restore point, and Ok it.
- Next, go to Start > Run and type in cleanmgr
- Select the More options tab
- Choose the option to clean up system restore and OK it.
CannonComp
Posts: 23 +0
Ok i have done all that thanks so much for your help
Blind Dragon
Posts: 3,774 +4
No problem, let me know in this thread if any more issues should come up.
Regards,
Blind Dragon
Regards,
Blind Dragon
- Status
Similar threads
Latest posts
-
Ryzen 7 5800X3D vs. Ryzen 7 7800X3D, Ryzen 9 7900X3D and 7950X3D- Lew Zealand replied
-
AMD Radeon RX 5700 XT Revisit: How Does It Compare Against the 7700 XT?- i like foxes replied
