I ran OTL this morning and shut down Avast, windows and Outpost firewalls, and shut down screen saver program, power for monitor, hard disk, standby all off.
I woke up to a shut down computer and hit the power button and searched for the OTL.txt and I did not find it. I’ve captured my search. I ended the Extras.Txt search since it could not find anything.
VuePrint crashes if the file directory is too large for it to access JPG files. The fact is “FireFox. Tools, Downloads, Open Containing Folder” brings up the files, but Explorer can’t find it. I don’t know the size of the subfolder previous to this event of file loss. However, I have all the files named in alphabetical order only showing files starting A and some in B, and there are 157 files, 3 folders, two of them sub-folders under A, 37.2 MB size on disk.
Yesterday I did a scan of the problem directory of missing files and one jpg had an error message,
“Error: Data error (cyclic redundancy check) (23)”. Before all this happened I was waiting for the Full System scan to finish because it had found a bug. I found that to be a trojan, JS:ScriptPE-inf[Trj].
This morning I ran OTL to directions posted:
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Select LOP and Purity
Under the Custom Scan box paste this in
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Attach both logs
I think the bug ate the log file. My computer was not supposed to shut down. All the power settings were set to never. You can only run OTL once? The OTL.exe is still on my computer from last September. I thought that was supposed be erased?
[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs
I ran OTL. I’ve attached OTL.txt. Extras.Txt was not found. I’m doing a scan to see if it is on my computer. I deleted the September OTL.exe, OTL…txt, Extras.Txt, and program directories from my system before running OTL. I shutdown Avast, Windows and Outpost Firewalls. The only thing I forgot to shutdown was the clock on the toolbar.
Thanks but I let the clock run. Why would FireFox be able to find files downloaded yet Explorer would not unless FireFox was not corrupted in its’ file organization with that directory. It just a thought.
Sandbox was not activated on the avast_free_antivirus_setup.exe 86k application. I could not do an online setup without a loss in dial-up connection. I could not go to version 9 online so I uninstalled Avast 8 after downloading Version 9. Previous post I was advised to upgrade as the Sandbox was running on its’ own. I’d like to send you my Explorer.exe file. I think that’s were the bug lives. What do I know? I just did an Explorer.exe search and its’ still going so I captured it.
Explorer came up negative for Virustotal. “Metascan-online found a threat” under the Antiy engine. All others were negative. I inverted metascan-online capture because it was hard to read. Jotti came up negative.
To me that looks clean, I can check it for you but I do not feel I will find anything
Download and Install Combofix
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
Combofix first download was corrupted under my Dial-up so I downloaded again. On the re-boot I had to shut down Malwarebytes, Outpost firewall. Avast, and the clock. When ComblFix first loaded I forgot my Avast.txt file which contains passwords and Session notes. So I closed it before Stage10. I checked my pictures sub-directory and it is still missing files. I have to use explorer to find out if it will crash my system with an error message. Can I do a CheckDisk or anything else to recover that data? I read with a cyclic redundancy check (23) there are procedures to recover sectors.
The only virus checker online that found a problem with Explorer was Antiy.net on Metascan-online. So I went to their site and found “Virus Submit Tools submit samples online”. It didn’t work and I went to CNET to rate Antiy.net and stumbled across a report stating that Mozilla FireFox dropped Trojan add ons. Antiy is first package Antiy-AVL FireFox recommends to cleanup your computer affected by the Add On’s, Avast is second.
http://download.cnet.com/8301-2007_4-10448331-12.html
“Mozilla recommends that users who suspect that they are infected use one of the following security applications to sweep and clean their computers after uninstalling the threatening add-on:
Antiy-AVL
Avast
AVG
GData
Ikarus
K7 AntiVirus
McAfee
Norman
VBA32
Infected users should note that only Avast and AVG are free.”
I just finished an search for the Trojan Add On’s with negative results.
Nothing to do but Check Disk and get some sleep.
My system has been freezing up. When I came home from work Friday morning my Earthlink dial-up connection was froze and I could not do anything else. There were no error messages so I rebooted. Firefox was up with 14 tabs open, 6 notepad files, 2 Sumatra PDF files, Windows picture and Fax Viewer, and Snagit screen capture program.
Saturday morning i had 17 FireFox tabs open but set to work offline. The system was slow to respond to commands. There was no error message. Other programs up were the same as before.
I rebooted and when I got up this afternoon I searched for remnants of Trojan.Spy.Agent,
Win32.Bifrose.32.Bifrose,and Win32.LdPinch.gen. Trojan.Spy.Agent was found by MalwareBytes, Win32.Bifrose.32.Bifrose with Sothink Web Video Downloader 4.0, and Win32.LdPinch.gen with Master Filer. According to Mozilla:
"Master Filer was removed from Mozilla’s Firefox add-on site on January 25, and the Sothink video downloader was removed on Tuesday. CNET Download.com ceased hosting the Sothink add-on on Friday before noon.
Sothink Web Video Download 5.5.90819 had been a mildly popular Firefox add-on at Download.com, receiving 697 downloads in the past week and 63,716 downloads since it was first added to the site in June 2007.
Because the Trojan horse programs are tied to Firefox, Mozilla warns, host computers won’t be infected until Firefox started. Uninstalling either add-on is only part of the solution, if the infection has already attacked the host computer. Mozilla recommends that users who suspect that they are infected use one of the following security applications to sweep and clean their computers after uninstalling the threatening add-on:
Antiy-AVL
Avast
AVG
GData
Ikarus
K7 AntiVirus
McAfee
Norman
VBA32
Infected users should note that only Avast and AVG are free."
According to Mozilla Avast is supposed to be able to correct any problems on my computer left from these FireFox Add-ons.