FBI Lockdown.

Status
Not open for further replies.

kuttus

Level 2
Verified
Oct 5, 2012
2,697
Finally you make it... Great... Lets complete the rest of the steps also.......

STEP 1: Run a HitmanPro scan
<ol>
<li><>Download the latest official version of HitmanPro</>.
<a href="http://www.surfright.nl/en/hitmanpro/" rel="nofollow" target="_blank"> <>HITMANPRO DOWNLOAD LINK</></a> <em>(This link will open a download page in a new window from where you can download HitmanPro)</em></li>
<li>Start HitmanPro by <>double clicking on the previously downloaded file.</> and then following the prompts.
<img src="http://malwaretips.com/images/removalguide/hpro4.png" alt="[Image: hitmanproscan4.png]" border="0" /></li>
<li>Once the scan is complete, a screen displaying all the malicious files that the program found will be shown as seen in the image below.After reviewing each malicious object click <>Next</> .
<img src="http://malwaretips.com/blogs/wp-content/uploads/2012/02/rsz_hpro5.png" alt="[Image: hitmanproscan5.png]" border="0" /></li>
<li>Click <>Activate free license</> to start the free 30 days trial and remove the malicious files.
<img src="http://malwaretips.com/images/removalguide/hpro6.png" alt="[Image: hitmanproscan6.png]" border="0" /></li>
<li>HitmanPro will now start removing the infected objects, and in some instances, may suggest a reboot in order to completely remove the malware from your system. In this scenario, always confirm the reboot action to be on the safe side.
</ol>
Add to your next reply, any log that HitmanPro might generate.
<hr />
You should be able to run both scans while in Normal mode...
STEP 2: Run a scan with Malwarebytes Anti-Malware in Chamelon mode

<ol>
<li>Download <>Malwarebytes Chameleon from <a title="External link" href="http://downloads.malwarebytes.org/file/chameleon" rel="nofollow external">here</a> </>and extract it to a folder in a convenient location</li>
<li>Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.</li>
<li>If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window <em><>Note:</> Do not attempt to open <>mbam-killer</> as that is not a Chameleon executable and serves a different purpose)</em></li>
<li>Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for yo</li>
<li>Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click <>OK</> when it says that the database was updated successful</li>
<li>Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan</li>
<li>Upon completion of the scan, if anything has been detected, click on <>Show Result</></li>
<li>Have Malwarebytes Anti-Malware remove any threats that are detected and click <>Yes</> if prompted to reboot your computer to allow the removal process to complete</li>
<li>After your computer restarts, open <>Malwarebytes Anti-Malware</> and perform a Full System scan to verify that there are no remaining threats</li>
Please add both logs in your next reply.
</ol>

<hr />
STEP 3: Run a scan with AdwCleaner

<ol><li>Download AdwCleaner from the below link.
<><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

<li>Close all open programs and internet browsers.</li>
<li>Double click on <>adwcleaner.exe</> to run the tool.</li>
<li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
<li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
<li>Please post the contents of that logfile with your next reply.</li>
<li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
</ol>
<hr/>
STEP 4: Run a scan with Junkware Removal Tool

Please download Junkware Removal Tool to your desktop from here
  • Turn off your antivirus software now to avoid potential conflicts
  • Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
  • The tool will open and start scanning your system
  • Please be patient as this can take a while to complete depending on your system's specifications
  • On completion, a log (JRT.txt) will be saved to your desktop and will automatically open
  • Post the contents of JRT.txt into your next reply


 
Last edited by a moderator:

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
Going to take me a little bit. tried to run hitman from usb on infected computer but apparently needs internet connection to scan.cant access internet here with laptop. going to relocate. guess running next few steps can be done from infected machine. thanks. be back shortly.
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
e]
HitmanPro 3.7.3.193
www.hitmanpro.com

Computer name . . . . : OD-PC
Windows . . . . . . . : 6.0.2.6002.X86/2
User name . . . . . . : od-PC\od
UAC . . . . . . . . . : Disabled
License . . . . . . . : Free

Scan date . . . . . . : 2013-04-03 23:19:43
Scan mode . . . . . . : Normal
Scan duration . . . . : 5m 28s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No

Threats . . . . . . . : 0
Traces . . . . . . . : 21

Objects scanned . . . : 1,717,158
Files scanned . . . . : 12,260
Remnants scanned . . : 249,761 files / 1,455,137 keys

Cookies _____________________________________________________________________

C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\1HP9JJFT.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\2XA2Q8E0.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\4U5HK90D.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\6ENOJAPA.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\A9X261JX.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\BNHN6N9T.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\C5JDHAAP.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\EF05NUMQ.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\F0VXQTAB.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\I84SCO55.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\J8J8D3Z6.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\JA70HG9H.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\K6NIXYHE.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\KQ3ILNPK.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\M8M8NFVU.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\R4KJ1YXI.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\RD6IBE5O.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\TKCIFJML.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\VN5460KZ.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\W3BV9FR7.txt
C:\Users\od\AppData\Roaming\Microsoft\Windows\Cookies\Z7YIMHQU.txt


[/code]
This is hitman log.No page loaded for 30 day free activation.Starting step 2 now.
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.04.03.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
od :: OD-PC [administrator]

4/4/2013 12:21:26 AM
mbam-log-2013-04-04 (00-21-26).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 205987
Time elapsed: 14 minute(s), 29 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
Having some trouble w/ the malwarebytes.not getting a second scan and activate button ask for a product key.will try to finish that and start the junkware tomorrow.concerned that nothing has been detected thus far.thanks for all your help so far.i will post the rest tomorrow. I appreciate your patience.
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
# AdwCleaner v2.200 - Logfile created 04/04/2013 at 18:17:48
# Updated 02/04/2013 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : od - OD-PC
# Boot Mode : Normal
# Running from : C:\Users\od\Music\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\.autoreg
Folder Deleted : C:\Program Files\GamesBar

***** [Registry] *****

Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\GamesBarSetup

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16470

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://my.netzero.net/s/search?r=minisearch --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://my.netzero.net/s/search?r=minisearch --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://my.netzero.net/s/search?r=minisearch --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Default_Search_URL] = hxxp://my.netzero.net/s/search?r=minisearch --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Search Page] = hxxp://my.netzero.net/s/search?r=minisearch --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - (Par défaut)] = hxxp://my.netzero.net/s/search?r=minisearch --> Empty data

-\\ Mozilla Firefox v3.0.19 (en-US)

File : C:\Users\od\AppData\Roaming\Mozilla\Firefox\Profiles\0dbrevhn.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [1730 octets] - [04/04/2013 18:17:48]

########## EOF - C:\AdwCleaner[S1].txt - [1790 octets] ##########
 

kuttus

Level 2
Verified
Oct 5, 2012
2,697
I think some of the logfiles are missing..... Please attach the full log files in your next replay....
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
[attachment=4141] Ok Kuttus ,here are the junkware log files.Are the log files missing from the adware log files? Not sure i'm attaching these properly.
 

Attachments

  • JRT.txt
    767 bytes · Views: 84

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
[attachment=4142] These are the adware files.
 

Attachments

  • AdwCleaner[S1].txt
    1.8 KB · Views: 103

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
Seems as though everything is ok so far.I can't thank you enough for all you have done. I am a little apprehensive since none of the scans really appeared to have found anything. I do have one concern and not sure it is related,but I can't log on as administrator such as when i was going thru the system restore steps. window opens and states i don't have administative privleges and many of my files and documents will not open they say "access denied".not sure what has happened there but how can i regain administrator? any suggestions would be greatly appreciated.
 

kuttus

Level 2
Verified
Oct 5, 2012
2,697
I recommend to create a new User Account with Admin Right instead of Administrator Account. You can create a new User Account from your Computer Control Panel...

To create a user account.

  1. To open User Accounts, click the Start button
    4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818.jpg
    , click Control Panel, click User Accounts and Family Safety, and then click User Accounts.
  2. Click Manage another account.
    18abb370-ac1e-4b6b-b663-e028a75bf05b_48.jpg
    If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
  3. Click Create a new account.
  4. Type the name you want to give the user account, click an account type, and then click Create Account.

<hr />
<hr />

I recommend to use the above steps only. Try the Following steps If you really needed. It should be our Last try... If something wrong happen to Administrator Account we may be help less.


By default the administrator account is disabled in windows vista and 7, to do some administrative level tasks you have to enable administrator account.


To enable administrator account in windows vista follow these simple steps:

Run Command Prompt (run as administrator)
Start Menu > Accessories > Command Prompt as shown below
209lwtf.png

Type the following command in the command prompt

net user administrator /active:yes
wji72w.png

You are done finally log off and check the hidden/disabled administrator account is available on the welcome screen.
equrlx.png


To disable the administrator account in windows vista & 7 just this command in command prompt.
net user administrator /active:no

Put ‘no’ in the end of the command instead of ‘yes’
 

kuttus

Level 2
Verified
Oct 5, 2012
2,697
Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.

For XP
How to create a Restore Point in XP
Delete all restore points except the most recent one

For Vista
Create a restore point
Delete all but the most recent restore point

For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link




Keep your system updated
  • Keeping your programs (especially Adobe and Java products) updated is essential. Update Checker will notify you if any of your programs require an update.
  • Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office product bugs and vulnerabilities.
  • Please ensure you update your system regularly and have automatic updates on. You can learn how to turn Automatic Updates on here


I also recommend you to switch your antivirus program to a better one. Here are some suggestions:

In addition to your antivirus, you need additional protection such as a firewall and behavioural blocker.


Here are only a few suggestions that will improve your system security. Should you wish to allow us to make full recommendations and set your PC up with maximum security, please start a thread here. Our community of PC enthusiasts and experts will give you feedback and help you secure your system from future malware infections.


Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.

Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.
  • KeyScramber - Encrypts your keystrokes to protect you against keyloggers that steals personal & banking information
  • AdBlock - Disable/blocks advertisements on websites so you won't accidentally click on a malicious ad.
  • NoScript - Disables Flash & Java contents to avoid exploits or drive-by attacks
  • Web of Trust - Shows the website rating by other users and blocks dangerous and poor-rated sites

Google Chrome is another good browser that is faster and more secure than Internet Explorer by having a sandbox feature. Additionally, you can add the following add-on to Chrome to heighten security.


Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.

Other than that, stay safe out there! If you have any other questions or concerns, feel free to ask :)

<hr />
What's next?
  1. Bulild up your malware defenses by starting a new thread in Security Configuration Wizard forum.
  2. Learn how to avoid malware by reading this article <a href="http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/">How to easily avoid malware</a>
  3. Be an active member in the MalwareTips community! :)



My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
Ok Kuttus, don't think i'm going to mess w/ administrator account. Are there any other scans i should run? Everything seems ok so far.Just want to make sure i get all the malware that could be hiding.Once again i just want to say what asset you and the malware tips team are to us out here.
 

dana k

New Member
Thread author
Verified
Apr 2, 2013
26
Thanks Kuttus. I didn't see your last post with all the recommendations before i posted. I will definately be taking your advice on all of it. Over the next few days I will be browsing thru the security configuration forum etc. and try to become a little better informed.. Job well done Kuttus and the Malware team!
 

kuttus

Level 2
Verified
Oct 5, 2012
2,697
This thread is now closed.​
Reason:&nbsp;<span style="color: #ff0000;">Issue Resolved</span>

<span style="color: #ff0000;"><>The procedures contained in this thread are for this user and this user only.&nbsp;&nbsp;Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair.&nbsp;&nbsp;</></span>

<span style="color: #ff0000;"><>DO NOT use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.</></span>

All members requesting Malware Removal Assistance are required to follow all procedures in the thread


My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.
 
Last edited by a moderator:
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top