Trojan detected after Java update

Viruses and worms
1

During the past week, I have been helped here for an infection on our laptop.
That created something like a lightbulb in my head (!): the PC has been turning somewhat funny on me since the last Java update. That PC was ticking like a clock until then. Could that be an infection?
The original download was way slowler than it usually is and then the system went sluggish. I restaured to the previous day. When I rebooted, the download went at the usual speed and the PC worked normally.
Though, a few odd things have happened since:

  • sometimes (not each time), when I boot the PC, windows tells me the system is not protected. I click on it. It tells me avast is not enabled and I should activate it. I proceed and it would not turn activated. And when I click on avast, avast tells me it IS activated. (???)
  • on an off, (not each time), Avast warns me of critical update. I click on it. It tells me Java Runtime environment 6 (32bits) should be updated. I proceed and the system tells me I have the latest version yet. and BTW, just below that warning regarding Java, I see a line “Java Runtime environment 7 (32 bits)” saying it is up-to-date. I am confused about this since to my undestanding, a newer version overwrites the older one.
  • finally, on and off, the screen blinks pinkish.

Anyway, when that lightbulb in my head turned on, I went for a thorough scan. Avast detected a Trojan. I quarantined it. I would like to know if this is enough or there is something else I should do.
I attach a screenshot of the quarantine.
Thanks,
Yveline

2

hey and welcome to the forum.

to be on the safe side lets have a malware expert have a look at your computer.

please follow this guide and attach your logs.

http://forum.avast.com/index.php?topic=53253.0

we need the logs from adwclener,mbam, otl and aswmbr.

3

Actually, older versions of java are not automatically removed or overwritten. Hence the messages you are getting.

The malware removal specialist will help with that issue, so wait for arrival.

4

Here are the logs from adwcleaner, mbam and OTL.
I’ll now try to proceed with the next step you advised.
Thanks,
Yveline

5

I just tried downloading aswMBR.exe as you said. The PC told me 35 mn download and counting down VERY slowly. That feels odd since that has not happened in years, which was several kinds of connections ago, plus the other tools downloaded in seconds.
Because I started having problems after I had an unusually slow download with Java, I just cancelled aswMBR.exe download. Please let me know if that long of a download feels right to you and if I should proceed.
Thanks,
Yveline

6

'Tis a good start.

You may download the aswMBR.exe file using another computer/connection/network and transfer the file over to your sick system via an USB stick. Be sure to use this program to prevent malware from entering the usb stick and infecting other systems if you do; or a blank cd will work just fine: http://www.mcshield.net/downloads.html I’d install this on all systems and allow it to update for protection prior to using an usb stick.

7

I feel that an emptying of the temp folders will remove the JS that are bad. Nothing else is apparent at this stage, although Java 7 does not appear to have installed properly

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

8

Oh… it seems you answered as I was proceeding aswMBR.exe.
Attached is the log.
I found it weird. The scan just stopped, with no warning that it was completed. I wondered whether it was stuck, but the “save” button was activated. So, I guess it is OK.
I’ll now do what you said with OTL.
Thanks, Yveline

9

As OTL was running, I had a windows warning: OTL stopped windows is going to look for a solution.
The menu at the bottom of the screen disappeared. You said it would come back when rebooting, but since OTL didn’t fully go through, I am not sure what I should do.
Yveline

10

Could you disable MBAM please and then re-run the OTL fix

11

How do I do that? I don’t have any start menu at the moment nor icon on the desktop.
Thanks,
Yveline

12

OK temporarily uninstall MBAM via control panel

13

How do I access the control panel? I do not have the start menu.
Yveline

14

I only a blue screen with nothing but that page.

15

OK… I ended up finding how to access the control panel through the task manager and I managed to unisntall Mbam.
Then, still through the task manager, I clicked on OTL.exe. That opened a notepad file whose content I paste below. I assume this is the log from the unfinished scan/correction. The second time I clicked on OTL.exe, the standard OTL screen, which I had yesterday, opened. I am going to run it now.

Files\Folders moved on Reboot…
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\00BPLJJX(25)\7740;;dcopt=ist;tile=1;um=0;us=13;eb_trk=157740;pr=20;xp=20;np=20;uz=Unknown;fbi=;sbi=;fbo=;sbo=;fse=;sse=;fvi=;svi=;cg=47cd83c313a0a47a09730e43f9996c18;[1].htm not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\TLKP68MM\DxGPfVXTeTI4ciNmB26VKdsyNaWJDmqFEmxoSzaMaQQXGcxc0CQcJGIbgJ9bQnOjMNOtwQ6S9DrXfO3TMLZ7ImpPK00jXjPEnbuYOhiqyw0fLvLOFGBGVJ5qo3NOhwQkz-rWyZeKXKpv9uHZmbv1F8JkY[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\R7T0RCRX\k_ZStIAkV9fvainbYlWXeN9eBKqvk1X81UbYHr60OGLxpY22eVeQmWR5An6nIlQpZUUQ1UsPuElVyF0qgHdIuj5I1KE8TPyKeI-e-q2mR6pK2MfGeNJ726qqbKoeRPLWodWAl_rGmBixQNUV1Q2lWRh_o[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\R2E3I78Q-3F_fVXTeTI4ciNb9o3nVRfuRfreCS92Pa4OxY-VNPt_bftccg0C9BkOxhNzxPc4ve1-I6x7n_YFtjsmqYbMkWa1V6wJckg9szPwaqAzw2vMq6Em-A0zsRBPTapze6Kbeg0myZeKXKpv9uHZmbv1F8JkY[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\I7ZD6BT8\ed33.ver.4.app.62dhh6thj8cb3.ver.31.app.64c1n65hm8o9m.ver.13.app.64c9hckojgeb5.ver.7.app.66c1j6ph68ohn.ver.31.app.68ohh6com6c1h.ver.8.app.6cdj26sq3cdb6.ver[1].8 not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\I7ZD6BT8\xCBir4Lfdpq7vPazk2s1HvHrWcOM4VA52dt59FywcczV0OqHwd0PrVvGiSzdpaZPHndiGE3IbiCS_31zz-Xo9IkBvzW9HLxrAmrnsykH53hhcVeILq-vnJ2nN0_BiZseCZiauoAB3fljpQSOEEWPv4qQE[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\I7ZD6BT8\xCBir4Lfdpq7vPu5LEl7wAisGcOM4VA52dt59FywcczV0OAkR1v6LoC7Lq8QSM4lGfAiGE3IbiCS_31zz-Xo9IkBvyy1KCErCgA5HJLDYnfs4bcOiOLUrICiJ0_BiZseCZiauoAB3fljpQSOEEWPv4qQE[1].jpg not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\933SLG6W\ed33.ver.3.app.62dhh6thj8cb3.ver.31.app.64c1n65hm8o9m.ver.13.app.64c9hckojgeb5.ver.7.app.66c1j6ph68ohn.ver.31.app.68ohh6com6c1h.ver.8.app.6cdj26sq3cdb6.ver[1].8 not found!
File\Folder C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content(103).IE5\8NZE1WI9\D-wAue5AD_vtNaHm0aFeOMNJrh0oX_mRP9L2ONCQ5BlwFVNePkNUIu2wJVRRaYrrwcnqQJaeE38VsjgTMwivYuP2_v1Oy-7SmCZ-wUTl7KFuuoBV3co26PYc0a8yoFho4YBcr0XIom4M6pemB-VdEby44[1].jpg not found!
C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Users\Rogine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat scheduled to be moved on reboot.
File move failed. C:\Windows\temp_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

16

This time, OTL ran normally, the PC rebooted, the start menu and the icons reappeared on the desktop.
I am attaching the log.
Thanks, Yveline

17

Could you now do a quick scan with Avast to confirm that the java malware has gone please

18

Avast quick scan said “no infected file”.
Yveline

19

Now that avast said “no infected file”, can I delete the tools I downloaded from what I was advised here? Is it good enough to delete from where they were downloaded? I can see a button called “purge tools” on OTL (getting confused).
Also, should I uninstall Java 6, which gives me a warning on avast? (I can see on the control panel Java FX2.1.1, Java ™ 6 update 26 and Java 7 update 25.
You said Java was not installed properly. Should I do something about it?
Thanks,
Yveline

20

For Java there is a small tool that will remove all old Java version, this can be deleted from the desktop once it has done its job

http://fileforum.betanews.com/detail/JavaRa/1207335071/1

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Run AdwCleaner and press uninstall
Delete AswMBR from the desktop
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

Clear Restore Points

Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
When it pops up at the first prompt select OK after it has done some calculations the tabs will appear
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button

https://dl.dropbox.com/u/73555776/disc%20clean.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave: