system
August 19, 2014, 1:22pm
1
Hello.
http://i159.photobucket.com/albums/t136/SnowMiyu/1a_zpsc20afdd6.jpg
http://i159.photobucket.com/albums/t136/SnowMiyu/2a_zpsd713d376.jpg
Avast detects tmp79C2.tmp as a virus and immediately moved it to chest. However, it reappears after a few seconds and the process repeats.
I’ve attached the logs from MBAM, FRST and aswMBR scans.
system
August 19, 2014, 1:46pm
2
I’ve run a scan on the two infected USB drives with MCShield.
OK that is one task less for you
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
HKU\S-1-5-21-1455169992-3332060913-318429238-1001\...\Run: [tmp79C2] => wscript.exe //B "C:\Users\SSA.K\AppData\Local\Temp\tmp79C2.tmp.vbs" <===== ATTENTION
Startup: C:\Users\SSA.K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\SSA.K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp79C2.tmp.vbs ()
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=MY&userid=59379638-88fa-3952-393e-1e1638f1bb1f&searchtype=ds&q={searchTerms}&installDate=21/11/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=MY&userid=59379638-88fa-3952-393e-1e1638f1bb1f&searchtype=ds&q={searchTerms}&installDate=21/11/2013
BHO: Freecorder extension x64 -> {B15BBE59-42F5-4206-B3F0-BE98F5DC4B93} -> C:\Program Files\Freecorder extension x64\ScriptHost.dll (Applian Technologies Inc.)
BHO-x32: No Name -> {000123B4-9B42-4900-B3F7-F4B073EFC214} -> No File
BHO-x32: No Name -> {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} -> No File
BHO-x32: No Name -> {3C6301ED-0F78-4AF2-8150-D9C052361A8E} -> No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - No Name - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} - No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
2014-08-16 14:07 - 2013-08-15 21:35 - 00000000 ____D () C:\Program Files (x86)\Betcat
Task: {4E93F970-26BD-4874-B89E-844183EBCF1D} - System32\Tasks\Express FilesUpdate => C:\Program Files (x86)\ExpressFiles\EFUpdater.exe <==== ATTENTION
Task: {D1A841F5-3175-4827-A74C-936A80C20D56} - System32\Tasks\Dealply => C:\Users\SSA.K\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\Dealply.job => C:\Users\SSA.K\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\Users\SSA.K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
C:\Program Files (x86)\MyPC Backup
C:\Users\SSA.K\AppData\Roaming\Dealply
C:\Program Files (x86)\ExpressFiles
2014-08-19 19:12 - 2013-09-24 16:00 - 00000000 ____D () C:\ProgramData\BitGuard
C:\Users\SSA.K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp79C2.tmp.vbs
C:\Users\SSA.K\AppData\Local\Temp\tmp79C2.tmp.vbs
C:\Users\SSA.K\AppData\Roaming\Betcat
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt , in the same location as FRST.exe
THEN
Download Anti VBS/VBE to your desktop
[]download the appropriate version (32 bit or 64 bit) and double click the file to run it. ]After a couple of seconds (might also take a whole minute if the machine is heavily infected and/or slow) a report will open in Notepad.
Be aware this is a very new programme and as such is not recognised by any Antivirus or Windows, it is safe so allow it to run
FINALLY
Please download AdwCleaner
[*]Close all open programs and internet browsers.AdwCleaner.exe to run the tool.Scan .Ok .C:\AdwCleaner[S1].txt as well.
system
August 19, 2014, 2:24pm
4
Alright. Done. Logs attached.
Pondus
August 19, 2014, 2:37pm
5
the VBSVBE log is saved as Unicode so not readable …
since it is short you can just copy and paste it here
How is the computer behaving now ?
system
August 19, 2014, 3:15pm
8
Everything seems good and normal.
I noticed VBSVBE made a backup folder which consisted:
http://i159.photobucket.com/albums/t136/SnowMiyu/Untitled-1_zps8203ebce.jpg
Should I do anything with this folder?
Yes you can delete that folder
Subject to no further problems
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Download and run Delfix
https://dl.dropboxusercontent.com/u/73555776/delfix.JPG
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java this article
I would recommend that you completely uninstall Java unless you need it to run an important software.disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser How to unplug Java from the browser
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent install this programme to lock down and prevent crypto ransome ware
https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG
Malwarebytes
Update and run weekly to keep your system clean
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe
system
August 21, 2014, 9:15am
10
I’m back to let you know there’s no further problems with my computer. The files in both of my USB drives have turned to normal.
Thanks a lot for the help!
