Virus in Favoriten gefunden

[DJBone]

Hallo Antje

Ich habe essexboy (Malware Spezialist) informiert. Er wird sich deines Problems annehmen. Seine Anweisungen sind allerdings in englisch bzw. "Google translated" deutsch. Aber keine Angst, wir können dir auch da weiterhelfen.

DJBone

[essexboy]

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will produce a log called FRST.txt in the same directory the tool is run from. 
  
• Please attach the log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also attach  that along with the FRST.txt into your reply.
  

[Antje]

@ Essexboy: Thank you for your kind support !

Enclosed you will find both logs of the FRST scan.

[essexboy]

Danke

Download the attached fix list.txt to the same place as FRST
Run FRST and press FIX
A log will be generated could you attach that please.

Otherwise the computer looks quite clean, how is it behaving 

[Antje]

@ essexboy: Thank you again!

Otherwise the computer looks quite clean, how is it behaving 

It seems that the computer has been a little bit more slowly for the last few weeks. The virus was found by the avast scan on Dec. 3rd.  Since then I have not really noted a change in the behavior of the computer.

Sorry for my bad English 

[Antje]

Hallo,

ich wollte nochmal an meinen Thread erinnern.
Könnte sich jemand noch den letzten log ansehen?

Kann ich davon ausgehen, dass mein Computer frei von Viren ist?

Viele Grüße,
Antje

[Machiavelli]

Ich werde Essexboy informieren.

[essexboy]

My apologies, for some reason I missed the notification 

Tut mir leid, aus irgendeinem Grund habe ich die Anmeldung verpasst

OK speed .. 

Clear Cache/Temp Files
Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.  Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

THEN

Could you run a disc defragment please and let me know how the computer is behaving

Ausführen könnte ein Datenträger defragmentieren bitte und lassen Sie mich wissen, wie der Computer verhält

[Antje]

@ essexboy: Nevermind! Thank you for your continual support !

During the TFC run, the following note was shown: "A critical error appears. Windows will be rebooted in one minute". However, the run was finished and 172 mb were cleared. Then the system was rebooted. As a precaution I started TFC again and 0 mb were cleared.

After that the disc defragment was running smoothly. And now the system is very, very fast 

Do you think, that the system is clear, now? I am a litle bit worried as I do online banking and I am not sure if it is safe again 

My apologies for my bad English again. I hope that my description is understandable. Otherwise I could write in German and perhaps someone may translate it 

[essexboy]

Compared to my German your English is excellent

The logs looked good

Is the computer running well now ?

[Antje]

Yes, the computer is running very well 

But it was also running quite well before the virus was found. It was just a bit more slowly  .

What shall I do with the infected (or suspect) file in the avast container? (The virus was found in my favourites). Do I have to delete the file?

[essexboy]

Yes delete it from the virus chest, it was probably an infected link

In that case methinks I will send you on your merry way

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

Clear Restore Points

Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
When it pops up at the first prompt select OK after it has done some calculations the tabs will appear
Select More Options tab
Press System Restore and Shadow Copies Cleanup button

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes.

Update and run weekly to keep your system clean


It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?Keep safe  :wave:

[Antje]

Essexboy, thank you very much for your support ! That was a great help for me !!!

Eine Frage hat sich soeben noch ergeben, die können mir sicher aber auch andere User beantworten, daher schreibe ich sie in Deutsch:

Ich habe nun den verdächtigen Favoriten im avast-Container gelöscht.  In den Lesezeichen (bei Mozilla) ist der LInk jedoch immer noch gespeichert.  Also habe ich den auch gelöscht. Allerdings befindet er sich nicht im Papierkorb, wo ich nachgeschaut habe, um ihn auch dort zu löschen.

Weiß jemand, wo bei Mozialla die gelöschten Lesezeichen zu finden sind? Oder kann ich das so auf sich beruhen lassen?

[Secondmineboy]

Das kannst du so beruhen lassen.

[Antje]

Oh, vielen Dank für die schnelle Antwort !

Da mein Englisch doch nicht so gut ist, könntest du mir noch sagen, warum es kritisch ist, ein Antivirenprogramm und die Firewall gleichzeitig laufen zu lassen? Essexboy hat das in seinem letzten Post geschrieben, aber ich befürchte, dass ich die Erklärung in Englisch womöglich nicht verstehen würde