Solved AV Security infected computer; seems clean, need help for prevention

[BinkerNate]

Sounds like you're on the right track. SUPERAntiSpyware (SAS) has recently changed their online scanner to a portable scanner, and I didn't realize that in my first post, sorry about that. SAS free edition would be my next weapon ( SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware! ) followed by Trend Micro HouseCall ( HouseCall - Free Online Virus Scan - Trend Micro USA ). You can't rely on just one or two scanners once your machine is infected, use them all! Please report back after those two scans.

Okay, Sandbox is installed. Housecall found nothing, while SUPERAnti found 277 threats including Startnow Toolbar.

edit: Once you run the two above scanners you can run Norton Power Eraser ( Norton Rescue Tools ) .............BEFORE YOU DELETE ANYTHING FOUND DURING THE NPE SCAN, REPORT BACK HERE FIRST!! NPE IS VERY AGGRESSIVE, AND CAN FIND FALSE POSITIVES.

Did so, and it found no risks. It did ask if I should let it restart for rootkits. I didn't accept that, but I wanted to ask if I should've.

Is this a sign of so far so good? What else?

Also, what about sweeper (relation to my previous question about it) and adobe might being the culprit or not?

 

[DBone]

SAS finding 277 threats tells me you need to do some house keeping, by using CCleaner to delete some tracking cookies from your browsers. Be advised though, that when you remove cookies to say this site for example, and you have it set to log you in automatically, then you'll have to re-enter your user name and password, so be ready for that. Also, delete all internet temp and windows temp files as well.

NPE wanted to scan for root kits that's why it asked for a reboot. You could scan again, it won't hurt anything until you select remove. As for Adobe, you could remove all versions via programs and features and then reinstall again. Filehippo has the Adobe exe's for download ( Browsers and Plugins Downloads - FileHippo.com ) just choose the Flash player that you need (32bit, 64bit, IE, Non-IE).

If you need help with Sandboxie you could PM me your phone # and I could talk you through set up if you want.

 

[Jacee]

You also need to clean out all temporary files and Update your Java.

Download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Info in 'quote box'...

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.

TFC only cleans temp folders. TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail. TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

Next,
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6.
  Java SE Downloads
• Scroll down to where it says "Java Runtime Environment (JRE) 6u29 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u29-windows-i586-p.exe to install the newest version.

 

[BinkerNate]

by using CCleaner to delete some tracking cookies from your browsers. Be advised though, that when you remove cookies to say this site for example, and you have it set to log you in automatically, then you'll have to re-enter your user name and password, so be ready for that. Also, delete all internet temp and windows temp files as well.

I think that's the cleaner I was talking about that was on my old computer! Yeah, I know what to expect. But, could you post a link to it so that I will know it's the right one and not fake one, just in case?

NPE wanted to scan for root kits that's why it asked for a reboot. You could scan again, it won't hurt anything until you select remove.

So I shoul scan again, this time with the reboot option, right?

If you need help with Sandboxie you could PM me your phone # and I could talk you through set up if you want.

There's more to do? I though it was ready.

P.S. I'll did uninstalled adobe as requested.

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says "Java Runtime Environment (JRE) 6u29 allows end-users to run Java applications".

I don't see that, I only see 7. Is this the right link?

 

[DBone]

FileHippo.com - Download Free Software is a great place to download software, and then keep your software updated. Adobe Flash, Java, CCleaner ect.. are all available there. MajorGeeks.com - Download Freeware and Shareware Computer Utilities. is also great.

Yes, you can scan again with NPE and this time do a root kit scan.

Sandboxie needs to be set up just a bit, nothing big though.

 

[BinkerNate]

@Jacee: how long does TCE last? I only ask because it seemed to had frozed and there wasn't anything I do but close it.

EDIT: Actually, should I do CCleaner first? And this is for DBone; what exactly am I suppose to check for CCleaner to clean out?

 

[DBone]

Default settings are good, and I would add all options for all of your browsers except for passwords. Also, look at what other applications that you have (Adobe Flash, Foxit Reader, Adobe Acrobat, ect..) and you can select those too. You can hit analyze first, and then double click any result to view it more in depth. CCleaner is really safe, so just add the browser options to IE, FireFox and Chrome (if you have them) and you're good to go.

 

[BinkerNate]

I accidently unchecked everything in the Windows tab. Applications is fine. So if I follow your advice; everything under Internet Explorer, Windows Explorer, and System should be checked except for saved passwords under Internet and network passwords under Windows, right?Don't touch Advanced?

UPDATE: Norton Safelite installed. I still need help in checking what for CCleaner as described above, as well as the TFC and Java help from Jacee.

 

[DBone]

Regarding CCleaner, in Windows Explorer, everything is checked from default except "network passwords". In system you can safely check everything for your first clean, then uncheck the bottom 3 for everyday maintenance. Nothing in advanced should be checked.

 

[BinkerNate]

STATUS:
CCleaner removed 256GB of memory that was cluttered, let's say. Wow! (referring to the GB memory increase).

TFC:
Unlike last time; TFC worked out and seems fine after the reboot.

Download the latest version of Java Runtime Environment (JRE) 6.
Java SE Downloads
Scroll down to where it says "Java Runtime Environment (JRE) 6u29 allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u29-windows-i586-p.exe to install the newest version.

I'm so sorry, Jacee. But I'am following the instructions above, and I just can't find what you're saying. I even copied what I'm suppose to read on the "find" tab, with no luck. I don't know what to do other than ask you again. Are you sure this site wasn't rewritten or something? I'm sorry to ask again.

Perhaps a snapshot to help me out?

 

[Britton30]

Hi BlinkerNate, Here are the Java uninstall instrutions as Jacee explained How do I uninstall Java on my Windows computer ?
Here is the manual offline installation. Java Downloads for All Operating Systems

 

[Jacee]

Here's a snapshot ...

 

[BinkerNate]

@Jacee: this is what I'm having trouble with: you say "Scroll down to where it says "Java Runtime Environment (JRE) 6u29 allows end-users to run Java applications" The site and your image says "Java SE 6 Update 29" is that it? If so, Windows Offline Installation does not pop nor appear when I click "Accept License Agreement".

I'm glad that we both know what the site looks like, but nothing of what you're I should do s actually said ON the site. I'm sorry if you get angry over this, but what's on the site is what you're saying.

 

[Jacee]

Click on the red download (JRE), click on your OS (x86 or x64). It will tell you that you have to accept the licence agreement, click okay then save the 'offline' download to your desktop. Right click to run as Administrator and install it.

You didn't say anything in your specs as to what version of Windows 7 you're running, so I can only guess.

 

[BinkerNate]

You didn't say anything in your specs as to what version of Windows 7 you're running, so I can only guess.

Home Premium

 

[Dwarf]

It makes no difference whether it is Basic, Home Premium, Professional or Ultimate, as the same version of JAVA will install on each edition. However, what is important is that you download the correct version for your architecture, i.e. 32-bit or 64-bit.

 

[BinkerNate]

You know what, I'm an idiot. I should've looked at the address of what the file I was suppose to dl was, that would've been so much easier instead of asking these questions over and over again. I'm sorry, guys.

Anyway, I'm about to do the Java, but one quick question: in Control Panel, the only Java I see is "Java(TM) 6 Update 24". I would assume that's it and nothing else, like hidden, right?

UPDATE:
As of right now; Java has been updated. I did it after doing some scans before uninstalling the old Java. I'm glad I did as MSE found two Rogues, and SUPEAnti found a Trojan (Privacy Proection, I did get hit again with that two days ago). Things seem okay.

What seems to be next? Am'I good?

 

[Jacee]

Besides your Network firewall, please read this aout third party firewalls ...
Best Free Firewall

You need the added protection!

 

[Britton30]

You know what, I'm an idiot. I should've looked at the address of what the file I was suppose to dl was, that would've been so much easier instead of asking these questions over and over again. I'm sorry, guys.

I'm glad I did as MSE found two Rogues, and SUPEAnti found a Trojan (Privacy Proection, I did get hit again with that two days ago). Things seem okay.

What seems to be next? Am'I good?

LOL, we all do that kind of thing. As to Privacy Protection, have you run a Malwarebytes scan too? Link in my sig.
Also Jacee posted a removal for it, http://www.sevenforums.com/system-s...tection-fake-virus-program-2.html#post1647201.

 

[BinkerNate]

Upon looking at their preferred best firewalls; I think I had Online Armor on my old computer. I can't remember it all that well, but if I do, I don't recall Online Armor being something I had that was good. It did its job, but then again, it always felt like for a "firewall" it wasn't doing it well. I was still having problems. Comodo seems good, but I don't like the idea that it could see Malware as safe automatically. PC Tools and Private Firewall are also good and probably are the best bets for me, but in the end; I just don't know. I don't want to get something and regret it later, and I always follow your guys advice, so which do you prefer? Also, do I have to have one firewall; is it possible to have two running (my Network, and whatever I choose)?

LOL, we all do that kind of thing. As to Privacy Protection, have you run a Malwarebytes scan too? Link in my sig.
Also Jacee posted a removal for it, What is privacy protection? Fake virus program?.

Yeah I did Malwarebytes on Safe Mode, but did it on Safe Mode (without the Networking). I don't want to think it's still here, even though my Java is updated and before that, MSE found that Rogue and SUPERAnti found a Trojan which seemed to eb Privacy Protection. Do you think I should do this regardless? If I do Safe Mode again, with networking, and run a scan with RKill and Malwarebytes; that won't screw my computer up, would it?