Author Topic: Trojan detected after Java update  (Read 14614 times)

0 Members and 1 Guest are viewing this topic.

Yveline

  • Guest
Trojan detected after Java update
« on: July 30, 2013, 10:59:39 PM »
During the past week, I have been helped here for an infection on our laptop.
That created something like a lightbulb in my head (!): the PC has been turning somewhat funny on me since the last Java update. That PC was ticking like a clock until then. Could that be an infection?
The original download was way slowler than it usually is and then the system went sluggish. I restaured to the previous day. When I rebooted, the download went at the usual speed and the PC worked normally.
Though, a few odd things have happened since:
- sometimes (not each time), when I boot the PC, windows tells me the system is not protected. I click on it. It tells me avast is not enabled and I should activate it. I proceed and it would not turn activated. And when I click on avast, avast tells me it IS activated. (???)
- on an off, (not each time), Avast warns me of critical update. I click on it. It tells me Java Runtime environment 6 (32bits) should be updated. I proceed and the system tells me I have the latest version yet.  and BTW, just below that warning regarding Java, I see a line "Java Runtime environment 7 (32 bits)" saying it is up-to-date. I am confused about this since to my undestanding, a newer version overwrites the older one.
- finally, on and off, the screen blinks pinkish.

Anyway, when that lightbulb in my head turned on, I went for a thorough scan. Avast detected a Trojan. I quarantined it. I would like to know if this is enough or there is something else I should do.
I attach a screenshot of the quarantine.
Thanks,
Yveline

Offline mikaelrask

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1556
Re: Trojan detected after Java update
« Reply #1 on: July 31, 2013, 08:24:12 AM »
hey and welcome to the forum.

to be on the safe side lets have a malware expert have a look at your computer.

please follow this guide and attach your logs.

http://forum.avast.com/index.php?topic=53253.0

we need the logs from adwclener,mbam, otl and aswmbr. 
Windows 8.1 amd a10-5700 64 bit
12 GB ram 1 tb hard drive. Avast 18, MBAM

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5639
  • Spartan Warrior
Re: Trojan detected after Java update
« Reply #2 on: July 31, 2013, 02:24:27 PM »
...Though, a few odd things have happened since:
- sometimes (not each time), when I boot the PC, windows tells me the system is not protected. I click on it. It tells me avast is not enabled and I should activate it. I proceed and it would not turn activated. And when I click on avast, avast tells me it IS activated. (???)
- on an off, (not each time), Avast warns me of critical update. I click on it. It tells me Java Runtime environment 6 (32bits) should be updated. I proceed and the system tells me I have the latest version yet.  and BTW, just below that warning regarding Java, I see a line "Java Runtime environment 7 (32 bits)" saying it is up-to-date. I am confused about this since to my undestanding, a newer version overwrites the older one.
- finally, on and off, the screen blinks pinkish.

Anyway, when that lightbulb in my head turned on, I went for a thorough scan. Avast detected a Trojan. I quarantined it. I would like to know if this is enough or there is something else I should do.
I attach a screenshot of the quarantine.
Thanks,
Yveline
Actually, older versions of java are not automatically removed or overwritten.  Hence the messages you are getting.

The malware removal specialist will help with that issue, so wait for arrival.
Windows 10 Home 64-bit 22H2 Avast Premier Security version 24.1.6099 (build 24.1.88821.762)  UI version 1.0.797
 UI version 1.0.788.  Windows 11 Home 23H2 - Windows 11 Pro 23H2 Avast Premier Security version 24.2.6105 (build 24.1.8918.827) UI version 1.0.801

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #3 on: August 01, 2013, 11:59:43 PM »
Here are the logs from adwcleaner, mbam and OTL.
I'll now try to proceed with the next step you advised.
Thanks,
Yveline

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #4 on: August 02, 2013, 12:10:05 AM »
I just tried downloading aswMBR.exe  as you said. The PC told me 35 mn download and counting down VERY slowly. That feels odd since that has not happened in years, which was several kinds of connections ago, plus the other tools downloaded in seconds.
Because I started having problems after I had an unusually slow download with Java, I just cancelled aswMBR.exe download. Please let me know if that long of a download feels right to you and if I should proceed.
Thanks,
Yveline

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5639
  • Spartan Warrior
Re: Trojan detected after Java update
« Reply #5 on: August 02, 2013, 06:17:48 AM »
'Tis a good start.

You may download the aswMBR.exe file using another computer/connection/network and transfer the file over to your sick system via an USB stick.  Be sure to use this program to prevent malware from entering the usb stick and infecting other systems if you do; or a blank cd will work just fine:  http://www.mcshield.net/downloads.html  I'd install this on all systems and allow it to update for protection prior to using an usb stick.
Windows 10 Home 64-bit 22H2 Avast Premier Security version 24.1.6099 (build 24.1.88821.762)  UI version 1.0.797
 UI version 1.0.788.  Windows 11 Home 23H2 - Windows 11 Pro 23H2 Avast Premier Security version 24.2.6105 (build 24.1.8918.827) UI version 1.0.801

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Trojan detected after Java update
« Reply #6 on: August 02, 2013, 03:06:00 PM »
I feel that an emptying of the temp folders will remove the JS that are bad.  Nothing else is apparent at this stage, although Java 7 does not appear to have installed properly

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #7 on: August 02, 2013, 11:28:46 PM »
Oh... it seems you answered as I was proceeding aswMBR.exe.
Attached is the log.
I found it weird. The scan just stopped, with no warning that it was completed. I wondered whether it was stuck, but the "save" button was activated. So, I guess it is OK.
I'll now do what you said with OTL.
Thanks, Yveline

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #8 on: August 02, 2013, 11:37:02 PM »
As OTL was running, I had a windows warning:  OTL stopped windows is going to look for a solution.
The menu at the bottom of the screen disappeared. You said it would come back when rebooting, but since OTL didn't fully go through, I am not sure what I should do.
Yveline

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Trojan detected after Java update
« Reply #9 on: August 03, 2013, 12:11:18 PM »
Could you disable MBAM please and then re-run the OTL fix

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #10 on: August 03, 2013, 08:44:23 PM »
How do I do that? I don't have any start menu at the moment nor icon on the desktop.
Thanks,
Yveline

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Trojan detected after Java update
« Reply #11 on: August 03, 2013, 10:11:49 PM »
OK temporarily uninstall MBAM via control panel

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #12 on: August 03, 2013, 10:29:45 PM »
How do I access the control panel? I do not have the start menu.
Yveline

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #13 on: August 03, 2013, 10:41:33 PM »
I only a blue screen with nothing but that page.

Yveline

  • Guest
Re: Trojan detected after Java update
« Reply #14 on: August 03, 2013, 11:29:53 PM »
OK... I ended up finding how to access the control panel through the task manager and I managed to unisntall Mbam.
Then, still through the task manager, I clicked on OTL.exe. That opened a notepad file whose content I paste below. I assume this is the log from the unfinished scan/correction. The second time I clicked on OTL.exe, the standard OTL screen, which I had yesterday, opened. I am going to run it now.

Files\Folders moved on Reboot...
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\00BPLJJX(25)\7740;;dcopt=ist;tile=1;um=0;us=13;eb_trk=157740;pr=20;xp=20;np=20;uz=Unknown;fbi=;sbi=;fbo=;sbo=;fse=;sse=;fvi=;svi=;cg=47cd83c313a0a47a09730e43f9996c18;[1].htm not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\TLKP68MM\DxGPfVXTeTI4ciNmB26VKdsyNaWJDmqFEmxoSzaMaQQXGcxc0CQcJGIbgJ9bQnOjMNOtwQ6S9DrXfO3TMLZ7ImpPK00jXjPEnbuYOhiqyw0fLvLOFGBGVJ5qo3NOhwQkz-rWyZeKXKpv9uHZmbv1F8JkY[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\R7T0RCRX\k_ZStIAkV9fvainbYlWXeN9eBKqvk1X81UbYHr60OGLxpY22eVeQmWR5An6nIlQpZUUQ1UsPuElVyF0qgHdIuj5I1KE8TPyKeI-e-q2mR6pK2MfGeNJ726qqbKoeRPLWodWAl_rGmBixQNUV1Q2lWRh_o[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\R2E3I78Q\-3F_fVXTeTI4ciNb9o3nVRfuRfreCS92Pa4OxY-VNPt_bftccg0C9BkOxhNzxPc4ve1-I6x7n_YFtjsmqYbMkWa1V6wJckg9szPwaqAzw2vMq6Em-A0zsRBPTapze6Kbeg0myZeKXKpv9uHZmbv1F8JkY[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\I7ZD6BT8\ed33.ver.4.app.62dhh6thj8cb3.ver.31.app.64c1n65hm8o9m.ver.13.app.64c9hckojgeb5.ver.7.app.66c1j6ph68ohn.ver.31.app.68ohh6com6c1h.ver.8.app.6cdj26sq3cdb6.ver[1].8 not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\I7ZD6BT8\xCBir4Lfdpq7vPazk2s1HvHrWcOM4VA52dt59FywcczV0OqHwd0PrVvGiSzdpaZPHndiGE3IbiCS_31zz-Xo9IkBvzW9HLxrAmrnsykH53hhcVeILq-vnJ2nN0_BiZseCZiauoAB3fljpQSOEEWPv4qQE[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\I7ZD6BT8\xCBir4Lfdpq7vPu5LEl7wAisGcOM4VA52dt59FywcczV0OAkR1v6LoC7Lq8QSM4lGfAiGE3IbiCS_31zz-Xo9IkBvyy1KCErCgA5HJLDYnfs4bcOiOLUrICiJ0_BiZseCZiauoAB3fljpQSOEEWPv4qQE[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\933SLG6W\ed33.ver.3.app.62dhh6thj8cb3.ver.31.app.64c1n65hm8o9m.ver.13.app.64c9hckojgeb5.ver.7.app.66c1j6ph68ohn.ver.31.app.68ohh6com6c1h.ver.8.app.6cdj26sq3cdb6.ver[1].8 not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\8NZE1WI9\D-wAue5AD_vtNaHm0aFeOMNJrh0oX_mRP9L2ONCQ5BlwFVNePkNUIu2wJVRRaYrrwcnqQJaeE38VsjgTMwivYuP2_v1Oy-7SmCZ-wUTl7KFuuoBV3co26PYc0a8yoFho4YBcr0XIom4M6pemB-VdEby44[1].jpg not found!
C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat scheduled to be moved on reboot.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...