Windows 7 - Virus: Backdoor:Win32/Fynloski.A keeps reappearing.

Encyclopedia entry: Backdoor:Win32/Fynloski.A - Learn more about malware - Microsoft Malware Protection Center

Hi,

This virus shows up every day whenever I run my computer. Microsoft Security Essentials detects and removes each time (yaa!) but does anyone know why it keeps appearing? or how I can stop it completely?

Thanks!

Hi,

It may be injected via something else that is on your system, and not being caught my MSE.

Download, install, update and run FREE Malwarebytes - post a log of the scan here so we can help further.

Regards,
Golden

Thanks for the reply! Here are my logs.
It did end up finding something so I removed it. Afterwards, I did a rescan and it didn't detect anything so hopefully it doesn't come back

Here is the log before I removed anything:
Malwarebytes Anti-Malware (Trial) 1.60.0.1800
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2011.12.28.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jelesa :: JELESA-PC [administrator]

Protection: Enabled

12/27/2011 9:19:31 PM
mbam-log-2011-12-27 (22-14-08).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 282856
Time elapsed: 52 minute(s), 42 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\Software\DC3_FEXEC (Malware.Trace) -> No action taken.

Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Svchost (Backdoor.Bot) -> Data: C:\Java\RE\uSvchost.com -> No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Users\Jelesa\AppData\Local\Temp\dclogs\2011-12-17-7.dc (Stolen.Data) -> No action taken.
C:\Users\Jelesa\AppData\Local\Temp\dclogs\2011-12-18-1.dc (Stolen.Data) -> No action taken.
C:\Users\Jelesa\AppData\Local\Temp\dclogs\2011-12-25-1.dc (Stolen.Data) -> No action taken.
C:\Users\Jelesa\AppData\Local\Temp\dclogs\2011-12-27-3.dc (Stolen.Data) -> No action taken.

(end)

Please uninstall Java, and Flash for the time being.

Also clean out your Temp folder in AppData.

I can't find Java/Flash installed on my computer? Its not in the "uninstall programmes" list and I did a search through my program files in the C:drive as well as the search on the start up menu.

As for the "Temp folder in AppData" I can't delete this file!!
FXSAPIDebugLogFile

it keeps saying its opened in windows explorer

OK. Now can you follow up using this online scanner:

ESET Online Scanner

Post back here when its done.

Regards,
Golden

Heres my ESET log


C:\Users\Jelesa\AppData\Local\Temp\RarSFX1\uSvchost.com probably a variant of Win32/Delf.NIKFSTJ trojan cleaned by deleting - quarantined
C:\Users\Jelesa\AppData\Local\Temp\RarSFX2\uSvchost.com probably a variant of Win32/Delf.NIKFSTJ trojan cleaned by deleting - quarantined
C:\Users\Jelesa\AppData\Local\Temp\RarSFX3\uSvchost.com probably a variant of Win32/Delf.NIKFSTJ trojan cleaned by deleting - quarantined
C:\Users\Jelesa\AppData\Local\Temp\RarSFX4\uSvchost.com probably a variant of Win32/Delf.NIKFSTJ trojan cleaned by deleting - quarantined
C:\Users\Jelesa\AppData\Local\Temp\RarSFX5\uSvchost.com probably a variant of Win32/Delf.NIKFSTJ trojan cleaned by deleting - quarantined
C:\Users\Jelesa\Documents\ICO\MsgPlusLive-490.exe a variant of Win32/MessengerPlus application cleaned by deleting - quarantined

Run a HitmanPro scan: Home - SurfRight

and report back

Hitmanpro log


<?xml version="1.0"?>
-<Log filesProcessed="7299" timeSpentInSecs="224" date="2011-12-28T12:18:19" version="3.6.0.137" scan="Normal" computer="JELESA-PC">-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:2o7.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:adbrite.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ad4game.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.coach.ca"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.eqads.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.geekswithblogs.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.networldmedia.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pointroll.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pubmatic.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.undertone.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserver.adtechus.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:at.atwola.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:burstnet.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:c.atdmt.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:c1.atdmt.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:chitika.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:clicksor.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:collective-media.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:dmtracker.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:eset.122.2o7.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:fastclick.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:getclicky.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:googleads.g.doubleclick.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:gr.burstnet.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:h.atdmt.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:kontera.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:livejasmin.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:media6degrees.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:microsoftsto.112.2o7.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:mm.chitika.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:mswmw7mobilemainprod.122.2o7.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:myroitracking.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookiesnestopinternet.122.2o7.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookiesointroll.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:realmedia.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:rotator.adjuggler.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:ru4.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:server.cpmstar.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:specificclick.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:static.getclicky.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:stats.buildtraffic.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:stats.itsssl.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:tacoda.at.atwola.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:trafficmp.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.burstnet.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:yieldmanager.net"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Local\Google\Chrome\User Data\Default\Cookies:zedo.com"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Roaming\Microsoft\Windows\Cookies\IHF22MH1.txt"/></Item>-<Item status="Deleted" score="0.0" type="Repair"><File path="C:\Users\Jelesa\AppData\Roaming\Microsoft\Windows\Cookies\O3RU22MM.txt"/></Item></Log>

Well.... is it fixed now ???
if not.....
try: Anti-rootkit utility TDSSKiller