Solved Network problem caused by malware

[vonvergara]

Still scanning with Sophos Virus Removal Tool.. Mind you that windows Action Center reports Avira being turned off while it is on. The notification wont go away even when I click it and confirm it.

 

[Broni]

Reinstall Avira when done with Sophos.

 

[vonvergara]

Sure thing.

Sophos log:

2015-05-27 15:59:47.497 Sophos Virus Removal Tool version 2.5.4
2015-05-27 15:59:47.497 Copyright (c) 2009-2014 Sophos Limited. All rights reserved.

2015-05-27 15:59:47.497 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2015-05-27 15:59:47.497 Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x300 PT=0x1 WOW64
2015-05-27 15:59:47.497 Checking for updates...
2015-05-27 15:59:55.940 Option all = no
2015-05-27 15:59:55.940 Option recurse = yes
2015-05-27 15:59:55.940 Option archive = no
2015-05-27 15:59:55.940 Option service = yes
2015-05-27 15:59:55.940 Option confirm = yes
2015-05-27 15:59:55.940 Option sxl = yes
2015-05-27 15:59:55.941 Option max-data-age = 35
2015-05-27 15:59:55.941 Option EnableSafeClean = yes
2015-05-27 15:59:57.151 Option vdl-logging = yes
2015-05-27 15:59:57.154 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-05-27 15:59:57.154 Machine ID: bf49efb33890431da3b032cb9a7d73d9
2015-05-27 15:59:57.161 Component SVRTcli.exe version 2.5.4
2015-05-27 15:59:57.161 Component control.dll version 2.5.4
2015-05-27 15:59:57.161 Component SVRTservice.exe version 2.5.4
2015-05-27 15:59:57.161 Component engine\osdp.dll version 1.44.1.2200
2015-05-27 15:59:57.161 Component engine\veex.dll version 3.60.0.2200
2015-05-27 15:59:57.161 Component engine\savi.dll version 8.1.7.2200
2015-05-27 15:59:57.167 Component rkdisk.dll version 1.5.30.0
2015-05-27 15:59:57.167 Version info: Product version 2.5.4
2015-05-27 15:59:57.168 Version info: Detection engine 3.60.0
2015-05-27 15:59:57.168 Version info: Detection data 5.14
2015-05-27 15:59:57.168 Version info: Build date 4/28/2015
2015-05-27 15:59:57.168 Version info: Data files added 345
2015-05-27 15:59:57.168 Version info: Last successful update (not yet updated)
2015-05-27 16:00:15.344 Update progress: proxy server not available
2015-05-27 16:01:19.597 Downloading updates...
2015-05-27 16:01:19.598 Update progress: [I96736] Looking for package C1A903B2-E63E-483b-982D-04BB9C457C60 1.0
2015-05-27 16:01:19.598 Update progress: [I49502] Found supplement SAVIW32 LATEST
2015-05-27 16:01:19.598 Update progress: [I49502] Found supplement IDE515 LATEST
2015-05-27 16:01:19.598 Update progress: [I49502] Found supplement IDE516 LATEST
2015-05-27 16:01:19.598 Update progress: [I49502] Found supplement IDE517 LATEST
2015-05-27 16:01:19.598 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 1
2015-05-27 16:01:19.598 Update progress: [I19463] Syncing product SAVIW32 54
2015-05-27 16:01:22.066 Update progress: [I19463] Syncing product IDE515 171
2015-05-27 16:01:22.804 Installing updates...
2015-05-27 16:01:23.406 Error level 1
2015-05-27 16:01:24.294 Update progress: [I19463] Syncing product IDE516 178
2015-05-27 16:01:24.294 Update progress: [I19463] Syncing product IDE517 1
2015-05-27 16:01:56.225 Update successful
2015-05-27 16:02:08.729 Option all = no
2015-05-27 16:02:08.729 Option recurse = yes
2015-05-27 16:02:08.729 Option archive = no
2015-05-27 16:02:08.729 Option service = yes
2015-05-27 16:02:08.729 Option confirm = yes
2015-05-27 16:02:08.729 Option sxl = yes
2015-05-27 16:02:08.731 Option max-data-age = 35
2015-05-27 16:02:08.731 Option EnableSafeClean = yes
2015-05-27 16:02:08.775 Option vdl-logging = yes
2015-05-27 16:02:08.777 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2015-05-27 16:02:08.777 Machine ID: bf49efb33890431da3b032cb9a7d73d9
2015-05-27 16:02:08.778 Component SVRTcli.exe version 2.5.4
2015-05-27 16:02:08.778 Component control.dll version 2.5.4
2015-05-27 16:02:08.778 Component SVRTservice.exe version 2.5.4
2015-05-27 16:02:08.778 Component engine\osdp.dll version 1.44.1.2200
2015-05-27 16:02:08.778 Component engine\veex.dll version 3.60.0.2200
2015-05-27 16:02:08.778 Component engine\savi.dll version 8.1.7.2200
2015-05-27 16:02:08.778 Component rkdisk.dll version 1.5.30.0
2015-05-27 16:02:08.778 Version info: Product version 2.5.4
2015-05-27 16:02:08.779 Version info: Detection engine 3.60.0
2015-05-27 16:02:08.779 Version info: Detection data 5.14G
2015-05-27 16:02:08.779 Version info: Build date 4/28/2015
2015-05-27 16:02:08.779 Version info: Data files added 345
2015-05-27 16:02:08.779 Version info: Last successful update 5/28/2015 12:01:56 AM

2015-05-27 16:45:24.203 Could not open C:\hiberfil.sys
2015-05-27 16:46:11.946 Could not open C:\pagefile.sys
2015-05-27 17:06:53.454 Could not open C:\System Volume Information\{33852af1-0301-11e5-b715-f83bf7efd633}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-27 17:06:53.455 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-27 17:06:53.455 Could not open C:\System Volume Information\{c3484a56-0469-11e5-9d42-98551a37c442}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-27 17:06:53.455 Could not open C:\System Volume Information\{c3484ad1-0469-11e5-9d42-98551a37c442}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-27 17:06:53.455 Could not open C:\System Volume Information\{f94c1db6-0226-11e5-98e6-db83a10fc249}{3808876b-c176-4e48-b7ae-04046e6cc752}
2015-05-27 17:09:00.014 >>> Virus 'Mal/VMProtBad-A' found in file C:\Users\Von\Desktop\2K Games\Binaries\Win32\buddha.dll
2015-05-27 17:09:00.014 >>> Virus 'Mal/VMProtBad-A' found in file HKU\S-1-5-21-830139751-45031778-2959669199-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-05-27 17:09:00.014 >>> Virus 'Mal/VMProtBad-A' found in file HKU\S-1-5-21-830139751-45031778-2959669199-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-05-27 17:09:00.014 >>> Virus 'Mal/VMProtBad-A' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-05-27 17:09:13.494 >>> Virus 'Mal/VMProtBad-A' found in file C:\Users\Von\Desktop\2K Games\Borderlands 2\Binaries\Win32\buddha.dll
2015-05-27 17:09:13.495 >>> Virus 'Mal/VMProtBad-A' found in file HKU\S-1-5-21-830139751-45031778-2959669199-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-05-27 17:09:13.495 >>> Virus 'Mal/VMProtBad-A' found in file HKU\S-1-5-21-830139751-45031778-2959669199-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-05-27 17:09:13.495 >>> Virus 'Mal/VMProtBad-A' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2015-05-27 17:17:31.281 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2015-05-27 17:17:31.282 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2015-05-27 17:17:35.117 Could not open C:\Windows\System32\config\components
2015-05-27 17:17:35.135 Could not open C:\Windows\System32\config\RegBack\DEFAULT
2015-05-27 17:17:35.136 Could not open C:\Windows\System32\config\RegBack\SAM
2015-05-27 17:17:35.137 Could not open C:\Windows\System32\config\RegBack\SECURITY
2015-05-27 17:17:35.139 Could not open C:\Windows\System32\config\RegBack\SOFTWARE
2015-05-27 17:17:35.140 Could not open C:\Windows\System32\config\RegBack\SYSTEM
2015-05-27 17:36:06.874 The following items will be cleaned up:
2015-05-27 17:36:06.874 Mal/VMProtBad-A

 

[Broni]

Update Adobe Flash Player: http://get.adobe.com/flashplayer/
Make sure you UN-check Yes, install McAfee Security Scan Plus

NOTE 1: Beginning with Adobe Flash Version 11.3, the universal installer includes the 32-bit and 64-bit versions of the Flash Player.
NOTE 2: While installing make sure you UN-check any extra garbage which wants to install alongside.

Update your Java version here: https://www.techspot.com/downloads/6463-java-se.html
Alternate download: http://www.java.com/en/download/manual.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.
Note 2: If you're running 64-bit system make sure you install BOTH, 32-bit and 64-bit Java.

===============================

Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download

DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create registry backup
• Purge System Restore
• Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.

 

[vonvergara]

All updated and operating. Loved that "Mr. Clean" reference too! Computer is up and running ready to return to its daily grind Thanks so much for helping Broni, really appreciated.

 

[Broni]

Yes!!

Good luck and stay safe