Hi, i was a little concerned about a possible virus outbreak on my pc this week, im hoping its ok now but id like to know if there is anything else i can do.
—next is what i wrote a day ago on notepad-----
Breakdown of what happened
i was alerted by avast that a dowload/webpage contained a virus (link: http://www.mediafire.com/download/or010rs0lpyu63p/Odesk_-_Test.rar)
i ignored it (i believed the source to be trusted) then i continued to download it
after it finished i tried to run it, and a message popped up saying “.net framework 4.0 or higher is required”
this message was generated from the program i believe from the basic view of it, no header nothing but a box and a message.
i know i have .net 4 since i use it everyday as a developer. but just to be sure i downloaded the latest. and still the same message popped up.
i just left it after that…
after 1 day i noticed the IE browser kept opening by itself, maybe once every couple of hours (VUBE.com) which concerned me a little but i had no time to fix it so i left it.
the next day avast started to throw out alerts
1- another file was detected almost as soon as my system booted, the network shield blocked an attempt to modify network settings, i immediately blocked it and quarantined the file
(Quarantinedetails - hckmd.exe , C:/windows/windows explorer/ , NO Virus detected).
2- the file i downloaded, i aipped it to send to another source for checking, when i unzipped it avast immediately picked it up and quarantined it.
(quarantine details, Odeskjobapplkication - Code.exe, desktop, Win32:Evo-gen[Susp]
3 another file detected cant remember when, i think it was during manual scan
(Quarantine details nsz78CC.tmp, located - users/myaccountname/appdata/local/temp/, Win32:Virus Somoto-F [PUP]. )
i noticed the time when i tried clicking the exe file, several files were created, they were cookies i think .txt and some other files (system files)
i remember clicking the exe a few times, which got my attention when several cookies all with the same name was listed in my file search
something like this
txt
txt
txt
sys
sys
sys
txt
txt
txt
sys
sys
sys
i deleted them already anyway, im certain they are related, the sys files all shared the same names, but there order was different for each batch. inside one of the sys files there was a URL, this is the contents of the file from notepad.
p ÐÔÅÃA`Î( 2 €Ä_΀ÐùìeÎ €ÐùìeÎ €Ä_Î¥ ca h t t p : / / o c s p . v e r i s i g n . c o m / M F E w T z B N M E s w S T A J B g U r D g M C G g U A B B S 5 6 b K H A o U D % 2 B O y l % 2 B 0 L h P g 9 J x y Q m 4 g Q U f 9 N l p 8 L d 7 L v w M A n z Q z n 6 A q 8 z M T M C E G Q b 6 C D O A g g T 8 y 1 N L Z X W f m c % 3 D
as of now i sometimes get a popup still, but ive scanned my pc with
sophos avast defender and some more i forgot, they show no viruses or anything as of now.
i even reinstalled google and IE, i still think its here though,
my computer seems slugish, and i get a poppup every now and then, its really not that often though, only once yesterday, but it maybe because of a site a went to.
i just feel like i have more cleaning since all thats been done is 3 files got quarantined, wont there be registry entries etc to clean up?
maybe itll speed up a little. ill keep you posted