FedEx Email

system · 2015-07-06T15:30:43.000Z

Anyone? Now what?

system · 2015-07-06T15:48:37.000Z

last file.

dbrisendine · 2015-07-06T17:27:26.000Z

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

[b]Update for Zip Opener

Zip Opener Packages[/b]

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

Download the attached Fixlist.txt file and save it to your desktop the same location as FRST64.exe is located.

NOTE. It’s important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting “Run as Administrator…” and press the Fix button just once and wait.

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/Press%20the%20FIX%20button_zpsdd5zi3mt.png

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Along with the log file, tell me how your system is running now.

system · 2015-07-06T18:04:48.000Z

I am not able to run the FRST64.exe. I receive an error message: “A required privilege is not held by the client.”

I am running from SafeZone and “Run as Administrator”, but still no luck. I tried moving the file outside of SafeZone, but I cannot see it when I do so.

dbrisendine · 2015-07-06T18:09:29.000Z

How did you run the scan?

Edit: What I mean is that the scans were run by an Administrator (meaning the user was acting as administrator) just fine so you should be able to do the same thing (for example, just double click to run FRST64.exe).

system · 2015-07-06T18:10:42.000Z

Originally?
I saved the .exe files to my desktop and ran them from there.

dbrisendine · 2015-07-06T18:24:44.000Z

Most likely what is happening is that you have a shortcut on your desktop that points to the true file (which the log shows as located here = Running from C:\avast! sandbox\S-1-5-21-213686681-1849411641-3850617695-1000\sfzone\C\Users\Jeff\Downloads).

If you have to, download the Fixlist.txt file and a copy of FRST64.exe to a USB drive (you can do this on a different computer if you have to). Plug the drive into your infected system and either move the files onto the desktop or just run them from the USB drive. The desktop will be faster but either one will work.

system · 2015-07-06T18:27:53.000Z

I did get it to start running off my desktop, but it appears to have hung up. The green slider bar hasn’t moved in 10 minutes.

system · 2015-07-06T18:30:40.000Z

still hung up, but I do have a fixlog.txt file (see attached).

dbrisendine · 2015-07-06T18:31:36.000Z

What step is it at? It should say some message in the status line (upper left hand corner of FRST). This may take a bit to clear the temp files from the system.

system · 2015-07-06T18:32:27.000Z

deleting temporary files…

dbrisendine · 2015-07-06T18:35:13.000Z

Sorry; posting at the same time. The fixlog shows that the utility is running the EmtyTemp routine; this can take a bit if there is a large amount of files to remove. The rest of the Fixlist seems to have functioned well also, so give the system some time to finish this last step.
Repost the log file when it is finished please.

system · 2015-07-06T18:35:52.000Z

OK.

system · 2015-07-06T18:48:06.000Z

it’s been over 30 minutes now…the green progress bar hasn’t moved at all.

dbrisendine · 2015-07-06T18:49:35.000Z

Give it another 15 and then reboot the system.

system · 2015-07-06T19:10:37.000Z

OK…I had to reboot, but I think everything is working. I’m now able to use Chrome and Adobe Reader.

file attached.

Now can you tell me what bug(s) I had? Are they fixed? What harm was done? Should I be concerned about anything?

thanks,
Jeff

Pondus · 2015-07-06T19:30:25.000Z

Now can you tell me what bug(s) I had?

These Fake mails usually contain a [b]upatre[/b] infected attachment. [b]Upatre[/b] is a downloader and will try to download additional malware

Upatre info:
www.symantec.com/security_response/writeup.jsp?docid=2013-112017-1113-99&tabid=2

https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=TrojanDownloader:Win32/Upatre.A#tab=2

dbrisendine · 2015-07-06T19:53:50.000Z

The main bug in your logs is gone; you can read more about it
here.

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

http://i1351.photobucket.com/albums/p785/dbreeze2/Scanners%20screens/AdwCleaner_v4111_zpsn56hzjza.png

- Click the [b]Scan[/b] button and wait for the scan to finish.
- After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: [b]Waiting for action. Please uncheck elements you don't want to remove.[/b]
- Click the [b]Clean[/b] button.
- [b]Everything checked[/b] will be deleted.
- When the program has finished cleaning a report appears.
- Once done it will ask to reboot, allow this

http://1.bp.blogspot.com/-vitKqfMQS4o/UEDylIQ7HJI/AAAAAAAABLc/Hx-IwqKoaxg/s1600/adwcleaner_delete_restart.jpg

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[S0].txt
Optional:

NOTE: If you see AVG Secure Search being targeted for deletion, Here’s Why and Here. You can always Reinstall it.

system · 2015-07-07T15:39:25.000Z

OK…that bit is now done. file attached.

what’s next?

dbrisendine · 2015-07-07T19:40:38.000Z

First >>>

Download the attached fixlist.txt file and save it to the Desktop. If you need to, you can also download a fresh copy of FRST64 from here and save that to your desktop. (The SafeZone copy may be removed by now.)

NOTE. It’s important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 by right clicking on the FRST64.exe file, selecting “Run as Administrator…”. The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show that it is ready to use (meaning there is no update found) and you can continue on. Press the Fix button just once and wait. The tool will create a restore point, process the script and ask for a restart of your system.

http://i1351.photobucket.com/albums/p785/dbreeze2/just%20stuff/Press%20the%20FIX%20button_zpsdd5zi3mt.png

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post the log in your next reply.

Second >>>>

Malwarebytes’ Anti-Malware

Please start Malwarebytes’ Anti-Malware from either the Start Menu shortcut or the desktop icon (if you have one).

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/Main%20Screen_zpsnnwza0ky.png

Once updated, please select Settings > Detection and Protection. Please ensure that “Scan for Rootkits” is selected along with Non-Malware Protection PUP and PUM are set to “Treat detections as malware”

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/Detection%20Settings_zpsaviydqil.png

Once the program has loaded and updated, select “Scan Now >>” to start the scan.

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/Main%20Screen_zpsnnwza0ky.png

The scan may take some time to finish, so please be patient.

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/mbam21-scaninprogress_zps38w26yvt.jpg

If any malware is found, you will be presented with a screen like the one below.

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/mbam21-removeselected_zpsg83p7wis.jpg

Make sure that everything is checked, and click Remove Selected. when the removal is completed, a summary screen will be presented.

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/mbam21-saveresults_zpszocfy4qr.jpg

At the bottom of this screen, click on Save Results and then on Text file (*.txt). Save the file to your desktop and click OK. Click Finish to return to the main screen and then close Malwarebytes.

http://i1351.photobucket.com/albums/p785/dbreeze2/MBAM2_0/v2-1-4-1018/mbam21-finish_zpshfl56bcn.jpg

Double click on log file you saved to your desktop; the log file will be opened in your default text file viewer (usually Notepad); select the whole text (Ctrl + A) and copy (Ctrl + c) it to paste here in a reply.

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Announcements