Author Topic: Relative's PC Is Infected....  (Read 10497 times)

0 Members and 1 Guest are viewing this topic.

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #15 on: April 18, 2012, 02:40:36 PM »
Jeff,

Here is the Run Fix output....


ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #16 on: April 18, 2012, 02:47:36 PM »
I got a little confused regarding what was needed on the new OTL scan so let me tell you what I did. I initially ran with just the options that were selected by default. I did not select All Users. The log for that is OTL_2. I ran the scan again with All Users selected. That log is OTL_3. I'm off to work now. I'll check back back in later today. Thanks!

jeffce

  • Guest
Re: Relative's PC Is Infected....
« Reply #17 on: April 18, 2012, 09:07:30 PM »
      Hi,

Malwarebytes

I see that you have Malwarebytes already on your computer.  Please open Malwarebytes, update it and then run a Quick Scan.  Save the log that is created for your next reply.
----------

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.



As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.
  • Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
  • Click the button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
  • Check
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin

scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push
  • Push , and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
----------

In your next reply please attach the logs made by Malwarebytes and ESET online scanner. 

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #18 on: April 19, 2012, 03:22:42 AM »
Jeff,

Here are the results from the most recent MBAM and ESET scans....

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.17.06

Windows Vista x86 NTFS (Safe Mode/Networking)
Internet Explorer 7.0.6000.16982
Jeff :: JEFF-PC [administrator]

4/18/2012 5:47:00 PM
mbam-log-2012-04-18 (17-47-00).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 179600
Time elapsed: 3 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

« Last Edit: April 19, 2012, 03:25:32 AM by ebozzz »

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #19 on: April 19, 2012, 03:29:48 AM »
Talk to me!  ;D

jeffce

  • Guest
Re: Relative's PC Is Infected....
« Reply #20 on: April 19, 2012, 01:51:51 PM »
Hi,

I had classes last night and couldn't get back until now.  Those both look good.  How is your system running?  :)

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #21 on: April 19, 2012, 02:17:22 PM »
No worries Jeff! I have not noticed any problems since the removal of the 14 items that were detected on the initial MBAM scan. The only browser in use on this machine is IE 7. I did notice that that it would not load initially (stalled) but it seems that was related to a Comcast add-on.

Once I identified the add-on and disabled it, the browser loaded just fine. Currently there is no security installed so I do not want to start surfing all over the place. I think that they were using a product, McAfee maybe, that is provided to them free of charge as Comcast customers but attempted to remove/re-install the application after getting hit. The installation was blocked. I did notice that there was something in one of the logs regarding the Install Shield.

Most of the things that I have installed since beginning to work on this box have been completed from the Safe Mode with Networking. The only exception to that is the installation of Puran Disk Defragmenter that I installed last night from the normal desktop without any issues. It was definitely in need of a defrag! On the initial runs of Puran, the hard drives sectors were mostly red indicating a high degree of fragmentation. Much better now. I'm sure that had an impact on the performance.

I've been primarily updating outdated software while waiting for your responses. There were some really old versions of Java, Flash, Adobe Acrobat Reader, etc., on this laptop. Quite a bit has been updated at this point. So, what do you think? Anything else we need to look at?
« Last Edit: April 19, 2012, 02:26:21 PM by ebozzz »

jeffce

  • Guest
Re: Relative's PC Is Infected....
« Reply #22 on: April 19, 2012, 04:17:05 PM »
Hi,

Sounds like you have a lot of it covered.  You already seemingly did the updates I was going to have you do anyway.  Oh...by the way...I didn't see you list it but be sure to update Internet Explorer to IE8.  Even if the browser is not used, Internet Explorer is the browser that Windows uses to do all updates so we want to make sure that is secure and up-to-date. 

I would suggest that you choose one of the following antivirus programs so that we can keep the system more secure.  I personally recommend Avast and use it myself, but Microsoft Security Essentials is good too.
I would recommend that you install one of these free Antivirus programs immediately. Just choose one:
Microsoft Security Essentials
Avast
----------

Providing there are no other malware related problems...

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :D  SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :D

This infection appears to have been cleaned, but I can not give you any absolute guarantees.  As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
----------

Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
----------

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Enable Protected Mode in Internet Explorer.  This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code.  To make sure this is running follow these steps:
  • Open Internet Explorer
  • Click on Tools > Internet Options
  • Press Security tab
  • Select Internet zone then place check next to Enable Protected Mode if not already done
  • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
  • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.
3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis.  With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly.  A tutorial on firewalls can be found here[/color].  **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS currentWindows XP users can visit Windows update   regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems.  Without these you are leaving the back door open.

6. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites.  WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

7.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?
 
Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #23 on: April 19, 2012, 08:33:55 PM »
Jeff,

My users on my home network primarily operate from a Linux environment but we do have a few Windows XP Pro & Windows 7 clients. My ISP use to provide Windows Live One Care free of charge and after Microsoft did away with that product, they went to a Norton's product that I did not like at all. After doing some research combined with some actual usage of various options, I decided to go with avast Internet Security (6 licenses) for my Windows needs. It's been a few years now and I'm still happy with that decision. As I stated in my previous post, they are probably going to use the free option from Comcast but I plan to certainly make the suggestion of using avast Free along with a good firewall.

Your suggestions are very good advice. It's not my machine therefore I can't just go making wholesale changes without some sort of approval. There are certainly some things installed on it that need to be discussed with my relative. For example, Google Desktop. I've personally never used it but if I am not mistaken it has been discontinued. If I am correct, it will probably be best to remove it. A few other things with similar concerns also need to be addressed.

Let me start the clean up process. I will check back in once completed or if I run into anything unexpected. I truly appreciate the help that you have provided...
« Last Edit: April 19, 2012, 08:35:39 PM by ebozzz »

jeffce

  • Guest
Re: Relative's PC Is Infected....
« Reply #24 on: April 20, 2012, 12:42:02 AM »
Sounds like a plan.  I am glad that I was able to help.  :)

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #25 on: April 22, 2012, 07:31:58 PM »
You know, cleaning up the infection on this laptop was easy! It's taking care of a lot of the neglected items that is generating the most work. Updating old drivers, removing unneeded software and updating old software that is still in use. It appears that updates for Service Pack 1 for Vista were refused so it would not allow me use the Windows Update function to do so. I've had to go directly to the Microsoft site to get SP 1. Hopefully once I have it installed and all updates are completed, Windows Update will offer any future updates normally. I think that I should be able to wrap this up today....  ;)

jeffce

  • Guest
Re: Relative's PC Is Infected....
« Reply #26 on: April 22, 2012, 08:21:51 PM »
Quote
I think that I should be able to wrap this up today....
8)

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #27 on: April 23, 2012, 01:12:11 AM »
This is becoming a severe headache. Apparently the owner of this laptop refused to update the OS to SP 1 when it was offered so now it is very difficult to get it installed. Support for Windows Vista without any service packs installed ended on April 12, 2010...... >:(

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33442
  • malware fighter
Re: Relative's PC Is Infected....
« Reply #28 on: April 23, 2012, 01:24:22 AM »
Well when jeffce has given you the OK, this could be helpful later on such a machine: http://fixitcenter.support.microsoft.com/Portal
First get this independant download of Service Pack 1
Vista SP1 download: http://www.microsoft.com/download/en/details.aspx?id=30

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

ebozzz

  • Guest
Re: Relative's PC Is Infected....
« Reply #29 on: April 23, 2012, 01:42:50 AM »
Polonus, I have already attempted to install the independent download of Vista SP 1. It fails. I'm back at the Microsoft site now researching and trying to sort it out....