I had to print my documents using someone else’s computer so I had to plug my USB storage drive in, however the owner wasn’t really updating his antivirus software so I had no clue that my USB storage drive was infected by this weejoeh.exe thingy. I used the USB drive again at home and realized that there were new applications that use folder icons inside it, namely ‘Love You’, ‘Money’, ‘Nude’, ‘Sex’, ‘System Volume Informaton’, and ‘weejoeh’. There were also other shortcuts, all with the location weejoeh (F:), namely ‘Favourites’, ‘Private’, ‘Passwords’, ‘Movies’, ‘Music’, ‘Search’, and ‘Pictures’. And there are two new folders that were hidden (I only saw them when I allowed hidden folders to be shown), ‘System Volume Information’ and ‘weejoeh’. My own folders were also hidden and the visible copies of them were applications.
My USB drive was located in drive F so I really have no idea what to do. I attempted to delete them all but then they came back so I checked my computer and realized that weejoeh copied itself to my computer already! It was inside a folder named ‘heojeew’ with the location C:\Users\Jolene\heojeew. I attempted to delete all files with the names ‘weejoeh’ and ‘heojeew’ but I couldn’t because according to Windows Task Manager, it’s running.
Avast doesn’t detect this as a virus. Please help! I can’t remove it!!! I can’t plug other devices anymore because of this problem.
Hi there run these two programmes. The first will clean the USB and the second will enable me to see where the problem lies
Download MCShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.
Uninstall the following two programmes using Control panel
File Type Assistant
Free File Viewer 2012
THEN
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\Run: [MSSMSGS] => rundll32.exe winzny32.rom,FhrXBZF
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\Run: [weejoeh] => C:\Users\Jolene\heojeew\weejoeh.exe [130179 2014-08-10] ()
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\MountPoints2: {460348d5-2b13-11dd-9836-0016d4268fbc} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\MountPoints2: {5a0b874e-6a45-11d9-8fa2-0016d4268fbc} - a2h2.com
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\MountPoints2: {5f538a02-780f-11dd-b5a0-0016d4268fbc} - F:\bar311.exe %1
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\MountPoints2: {7d774a2d-2eb3-11dd-8f32-0016d4268fbc} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\MountPoints2: {9df07dfc-2b18-11dd-abf3-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
HKU\S-1-5-21-418808599-124273002-2944462063-1001\...\MountPoints2: {f61f227d-e323-11de-b14e-0016d4268fbc} - mbvd.exe
Startup: C:\Users\Jolene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\weejoeh.lnk
ShortcutTarget: weejoeh.lnk -> C:\Users\Jolene\heojeew\weejoeh.exe ()
URLSearchHook: HKCU - (No Name) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - No File
URLSearchHook: HKCU - (No Name) - {C3E3DDD5-BAD5-4717-AA77-14E141548B83} - No File
URLSearchHook: HKCU - (No Name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
URLSearchHook: HKCU - (No Name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - No File
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {B3535C18-0E70-4D4B-B36B-BBFE139BB144} - No File
Toolbar: HKCU - No Name - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKCU - No Name - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No File
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/MyFunCardsInitialSetup1.0.1.1.cab
U3 azdcjekv; C:\Windows\system32\Drivers\azdcjekv.sys [0 ] (Microsoft Corporation)
C:\Users\Jolene\heojeew
C:\Windows\system32\Drivers\azdcjekv.sys
2014-08-24 20:15 - 2014-08-24 20:16 - 00000000 ____D () C:\Program Files\GUM369A.tmp
2014-08-23 02:40 - 2014-08-24 19:46 - 00000000 _RSHD () C:\Users\Jolene\heojeew
Task: {5938B487-D471-44A5-B6A2-D5EB74A675A9} - System32\Tasks\FreeFileViewerUpdateChecker => C:\Program Files\FreeFileViewer\FFVCheckForUpdates.exe [2012-10-13] (Bitberry Software)
Task: C:\Windows\Tasks\FreeFileViewerUpdateChecker.job => C:\Program Files\FreeFileViewer\FFVCheckForUpdates.exe <==== ATTENTION
C:\Program Files\FreeFileViewer
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
FINALLY
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.
It’s faster than before. Whew! And the weejoeh thingy is COMPLETELY gone!
Thank you! Even other programs that I’ve been wanting to remove are gone…all those nasty toolbars that my mother unintentionally removed but could not be completely installed -_- finally gone!!! ;D
WARNING:Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disableJava in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent install this programme to lock down and prevent crypto ransome ware
