« previous next »
Pages: 1 [2] 3   Go Down

Author Topic: Whilokii Malware  (Read 13183 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Whilokii Malware
« Reply #15 on: November 24, 2013, 04:10:26 PM »
You are the second person to report that.. I will remove Filehippo from my recommended sites until I find out what is happening

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aartemis.com/?type=hp&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aartemis.com/?type=hp&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=ds&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077&q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "aartemis"
FF - prefs.js..browser.search.selectedEngine: "aartemis"
FF - prefs.js..browser.startup.homepage: "http://aartemis.com/?type=hp&ts=1385302242&from=cor&uid=SAMSUNGXHD204UI_S2H7J1BZC13077"
[2013/11/24 07:11:03 | 000,000,000 | ---D | C] -- C:\Users\JRB\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
[2013/11/24 07:10:36 | 000,000,000 | ---D | C] -- C:\Users\JRB\AppData\Roaming\DigitalSite
[2013/11/24 07:24:28 | 000,000,284 | ---- | M] () -- C:\windows\tasks\DigitalSite.job

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Please download Junkware Removal Tool to your desktop.
  • Right-mouse click JRT.exe and select "Run as Administrator" the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • post the contents of JRT.txt into your next message.
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #16 on: November 24, 2013, 04:20:28 PM »
http://aartemis.com/ is still opening, I checked chrome settings and it's set correctly to what I usually have my homepage set to.  Here's that file after running the fix.

john
Logged

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Whilokii Malware
« Reply #17 on: November 24, 2013, 04:22:23 PM »
I would not use the Filehippo updater.
It checks with the versions on Filehippo, not with the versions of the original developers like avast software updater does.
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #18 on: November 24, 2013, 04:41:13 PM »
I just ran JRT and am still getting the http://aartemis.com/ on open.  By the way what's a "spider" as below it has guests, users and 'spiders' online?  Thank you very much for all of your help Essexboy and crew!

john
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #19 on: November 24, 2013, 04:54:09 PM »
I have also got a 'PDF reader packages' installed today that I gives me a message that I can't uninstall it.  That was part of the Hippo ordeal.

john
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Whilokii Malware
« Reply #20 on: November 24, 2013, 06:18:19 PM »
My apologies for that .. I have removed Filehippo until I can determine what happened


For 32bit systems, please download SystemLook from one of the links below and save it to your Desktop.
 
Download Mirror #1
Download Mirror #2
 
For 64bit systems, download SystemLook from here.
 
 
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
Code: [Select]
:regfind
aartemis.com
aartemis
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

 
Note: The log can also be found on your Desktop entitled SystemLook.txt
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #21 on: November 24, 2013, 10:34:05 PM »
No worries, you've helped a ton!   I do appreciate it!

john
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Whilokii Malware
« Reply #22 on: November 24, 2013, 11:32:07 PM »
This should kill it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
@=""C:\Users\JRB\AppData\Local\Google\Chrome\Application\chrome.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\shell\open\command]
@=""C:\Users\JRB\AppData\Local\Google\Chrome\Application\chrome.exe"
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\aartemisSoftware]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\aartemisSoftware\aartemishp]

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #23 on: November 25, 2013, 12:28:26 AM »
Here's that log.  Still opening to the search tab and ad page though.

jb
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #24 on: November 25, 2013, 12:38:49 AM »
Just an FYI also, I have a program called "PDF Reader Packages" with no publisher that won't uninstall showing up in my "Programs and Features" window.  It was part of the Hippo files.  When I try and uninstall it, the message says "it has already been deleted".

jb
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Whilokii Malware
« Reply #25 on: November 25, 2013, 03:34:10 PM »
Is this in all browsers or just one ?

Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Attach  the entire report in your next reply.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #26 on: November 25, 2013, 05:07:44 PM »
Aartemis is opening in all browsers.  On MBAM scan it came up with no malicious files and no restart was necessary.  I have the current update with MBAM as well as per the instructions.  I still have the PDF Reader Packages showing in my Program features window for uninstall/change programs that showed up with the Hippo updates.  I attached the requested document from the scan that I just ran.

john
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Whilokii Malware
« Reply #27 on: November 25, 2013, 06:16:50 PM »
Lets try a slightly different programme

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will produce a log called FRST.txt in the same directory the tool is run from. 
  • Please copy and paste log back here.
  • The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
Logged

John Blixt

  • Guest
Re: Whilokii Malware
« Reply #28 on: November 25, 2013, 06:32:59 PM »
Here are the files from the scan.

john
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Whilokii Malware
« Reply #29 on: November 25, 2013, 07:52:35 PM »
Ta that showed me the additional areas that I need to set OTL to look in :)

Download the attached fixlist.txt to the same location as FRST
Run FRST and press fix
On completion a log will be generated please post that

Logged
Pages: 1 [2] 3   Go Up
« previous next »