dosulli,

Welcome to the forums! I'm Crush and I'll be helping you disinfect your PC.

Some things to keep in mind as we go through the disinfection process:

1. We are all volunteer staff here at PCHF so, we get on and assess threads when school, work, and other obligations permit. There may be a bit of a delay in response due to this.

2. Malware Removal threads are very time intensive. Each entry needs to be researched so we can say with certainty whether or not it needs to stay or go so, there may be a bit of a time delay in response due to this.

3. Despite the potential for time delays, things getting in the day, and the ability for this to turn into a rather long ordeal we will stick with you until the end and get you disinfected.

4. Please be sure you have read Prework in its entirety, in addition to all the linked threads from it. They are all important

5. Do not run any tools or perform any fixes unless specifically requested to do so by myself or another PCHF Security Analyst. The results could be disastrous

6. If you have any questions or issues with any of the instructions PLEASE stop and ask. We are here to help.

With that out of the way, on to the next steps:

Your logs show some vulnerabilities we need to clean up


We need to update your version of Adobe Reader. Older versions are susceptible to attack.

Please go here and get the latest version
============================================

Next, Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

=============================================


Please download Malwarebytes' Anti-Malware from one of these places:

https://www.cleverbridge.com/342/coo...%3ddl-10804572

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, navigate to the Update tab and click Check For Updates. It will then download the latest updates for you
* Now navigate back to the Scan tab
* Select "Perform Full Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire report in your next reply along with a fresh HijackThis log.

Please Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
=========================================

Finally, go HERE to run Panda ActiveScan 2.0

• Click the big green Scan now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• Once the scan is completed, please hit the notepad icon next to the text Export to:
• Save it to a convenient location such as your Desktop
• Post the contents of the MBAM log and ActiveScan.txt in your next reply

Malwarebytes' Anti-Malware 1.41
Database version: 2914
Windows 5.1.2600 Service Pack 3

06/10/2009 13:51:18
mbam-log-2009-10-06 (13-51-18).txt

Scan type: Full Scan (F:\|H:\|I:\|)
Objects scanned: 145515
Time elapsed: 1 hour(s), 20 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL \CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Do you have the ActiveScan log?

Here's the active scan that I haven't got around to doing. I think it doesn't matter anyway as the folder has been turned into a 32kb file by check disk on start up a few days ago. The file just called "f" is listed as 32kb but still seems to be taking up the space the original folder was taking up so maybe the data is still there but can't be retrieved or whatever due to data sectors being damaged. Doubt it's recoverable at this stage.

;************************************************* ************************************************** ************************************************** ******************************
ANALYSIS: 2009-10-21 22:22:35
PROTECTIONS: 1
MALWARE: 15
SUSPECTS: 0
;************************************************* ************************************************** ************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;================================================= ================================================== ================================================== ==============================
AVG Anti-Virus Free 8.5 Yes Yes
;================================================= ================================================== ================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;================================================= ================================================== ================================================== ==============================
00145881 Cookie/NewMedia TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@anm.co[1].txt
00145881 Cookie/NewMedia TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@anm.co[2].txt
00147814 Cookie/AspinallsOnlineCasino TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@pacificpoker[1].txt
00147814 Cookie/AspinallsOnlineCasino TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@pacificpoker[2].txt
00148914 Cookie/Tucows TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@tucows[2].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@com[2].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@com[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No H:\DOSULLI8\Local Settings\Temp\Cookies\dosulli8@xiti[2].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@xiti[2].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@xiti[1].txt
00167747 Cookie/Azjmp TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@azjmp[1].txt
00167747 Cookie/Azjmp TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@azjmp[3].txt
00168069 Cookie/Bilbo.counted TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@bilbo.counted[1].txt
00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@www.burstbeacon[2].txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@stat.onestat[2].txt
00168116 Cookie/Comclick TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@fl01.ct2.comclick[1].txt
00170559 Cookie/Com.com TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@uol.com[2].txt
00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@metriweb[1].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@go[1].txt
00194327 Cookie/Go TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@go[2].txt
00286732 Cookie/Cgi-bin TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@cgi-bin[2].txt
01606636 Cookie/Adserver TrackingCookie No 0 Yes No H:\DOSULLI8\Cookies\dosulli8@adserver.easyad[1].txt
;================================================= ================================================== ================================================== ==============================
SUSPECTS
Sent Location
;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================
VULNERABILITIES
Id Severity Description
;================================================= ================================================== ================================================== ==============================
;================================================= ================================================== ================================================== ==============================

So, no change? Dp you still wish to pursue this?

No change, Am I right in guessing the folder is unrecoverable as it has been changed to a file?

I would imagine so, yes