And yet another "Java Software Critical Update" virus problem

[Leo Niehorster]

Hi again,

Thanks. I have the manual. Is there anything I should know / do before I disconnect from the internet / this thread?

Leo

 

[TwinHeadedEagle]

Just reset your router and let me know how is computer after.

 

[Leo Niehorster]

Hi,

OK. Factory Reset done. Java Virus still present.

Leo

 

[TwinHeadedEagle]

You sure you did reset right?

 

[Leo Niehorster]

Good afternoon (at least here it is),

Yes. I have reset using the indicated recessed button on the bottom of the router.
The router has also been reconfigured.

Now what?

Leo

 

[TwinHeadedEagle]

Tell me in which browser you have this problem?

Also, run FRST, check Addition.txt, press Scan and attach both reports.

 

[Leo Niehorster]

The virus appears in all four browsers I have:
SeaMonkey
Chrome
Firefox
Internet Explorer

 

[TwinHeadedEagle]

Can I see the picture of Pop-up?

 

[Leo Niehorster]

Hi,
Here it is. Taken with Chrome as browser.

 

[TwinHeadedEagle]

Try this

https://support.google.com/chrome/answer/3296214?hl=en

Tell me is Chrome fixed after this.

 

[Leo Niehorster]

Hi,

Unfortunately, nothing has changed in Chrome. Java virus still replaces the page visited. Clicking "Back one page" brings you to the previous page, not the one where you wanted to go. I mean, I was on page A, went to page B, then the virus took me to page C. Upon clicking the "Back one page", I found myself on A again.

Leo

 

[TwinHeadedEagle]

Very stubbor virus, I don't see any sign of it in reports:

Let's try one more tool:

• Please download RogueKiller and save to the desktop.
• Close all windows and browsers
• Right-click the program and select 'Run as Administrator'
• Press the Scan button.
• A report opens on the desktop named - RKreport.txt
• Please post it in your next reply.

 

[Leo Niehorster]

Hi,
Indeed, it seems to be very hidden.

See RogueKIller log attached.

Leo

 

[TwinHeadedEagle]

Let's try this:

Open CommandPrompt and type following commands one by one:


ipconfig /flushdns

ipconfig /renew

Let me know how is computer after this.

 

[Leo Niehorster]

Hi,
I used the two command prompt commands, but unfortunately, the Java virus still appears.

Leo

 

[TwinHeadedEagle]

Let's try this:


Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

[Leo Niehorster]

Good evening,

Here are the two logs:

 

[TwinHeadedEagle]

Please try to uninstall Java from Control Panel and see if this helped. Can you also tell me when this started to happen, what did you do?

 

[TwinHeadedEagle]

> Re-run zoek with the script below and attach here fresh zoek log results.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Domaiq;a
Domaiq;z

 

[Leo Niehorster]

Hello,
Sorry for the delay.

The uninstalling and reinstalling of Java did not work. Note that the virus has appeared intermittantly before, and only on some sites.

I have run Zoek with your latest script. See attached log.
(Still getting the Java virus.)
(Your thread message of 11:00 PM was not advised per email)

I have reinstalled Avira, which had for many years not allowed anything to slip through.
Will see if this was a mishap, or if its protection is no longer effective.

I still have the icons of ComboFix visible in Explorer, with its endless copies. Any idea of how to eliminate this strange item? (See attached image of Windows Exporer tree).

Cheers
Leo