Trojan JS:ScriptPE-inf [Trj] on site - Page 2
Solved
Previous
- 1
- 2
-
Hi, don't worry Severine, everything is fine, we're almost done:
Download HostXpert to your Desktop:
---> Extract it (Right-click >> Extract here)
---> Double-click on HostsXpert to launch it
---> Click on the "Restore MS Hosts File" button and then close the program
PS: Before clicking on the "Restore MS Hosts File" button, make sure the lock icon in the top left is open; otherwise, you will get an error message.
If it's closed, click on it :)
Delete HostXpert
then:
You should remove the installers lying around in Program Files (Filezilla, there are two or three :))
then:
Uninstall Ad-Aware, it is unnecessary at this time (outdated)
then:
---> Disable your antivirus while performing this operation as OTMoveIt3 is mistakenly detected as an infection.
---> Download OTMoveIt3 (OldTimer) to your Desktop:
---> Double-click on OTMoveIt3.exe to launch it.
---> Copy (Ctrl+C) the following text below:
:processes
explorer.exe
:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=-
"Adobe Reader Speed Launcher"=-
"SunJavaUpdateSched"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=-
"MsnMsgr"=-
"TomTomHOME.exe"=-
:commands
[purity]
[emptytemp]
[start explorer]
[reboot]
---> Paste (Ctrl+V) the text you previously copied into the Paste Instructions for Items to be Moved box.
---> Now click the MoveIt! button and then close OTMoveIt3.
If a file or folder cannot be deleted immediately, the software will ask you to restart.
Accept by clicking YES.
---> Post the report located in this folder: C:\_OTMoveIt\MovedFiles\
The report name corresponds to the time of its creation: date_time.log
then:
Once all this is done, I think we can clean up :)
--
®© ----™g3и-н@¢км@и™---- ©® -
Here is the report, I also removed everything you advised me :)
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NeroFilterCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MsnMsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\TomTomHOME.exe deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Severine\LOCALS~1\Temp\etilqs_R0gIlav0lAb3tmUJxlft scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Severine\LOCALS~1\Temp\~DF2137.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Severine\LOCALS~1\Temp\~DF214B.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Severine\LOCALS~1\Temp\~DFD01E.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Severine\LOCALS~1\Temp\~DFD039.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7bc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03282009_104050
Files moved on Reboot...
File C:\DOCUME~1\Severine\LOCALS~1\Temp\etilqs_R0gIlav0lAb3tmUJxlft not found!
File C:\DOCUME~1\Severine\LOCALS~1\Temp\~DF2137.tmp not found!
File C:\DOCUME~1\Severine\LOCALS~1\Temp\~DF214B.tmp not found!
File C:\DOCUME~1\Severine\LOCALS~1\Temp\~DFD01E.tmp not found!
File C:\DOCUME~1\Severine\LOCALS~1\Temp\~DFD039.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_7bc.dat not found!
C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Severine\Local Settings\Application Data\Mozilla\Firefox\Profiles\w62i0ojz.default\XUL.mfl moved successfully. -
ok your startup will be faster than before now ... moreover, we will gain even more:
Download: ATF Cleaner by Atribune
Double-click ATF-Cleaner.exe to launch the program.
In the Main tab, choose: Select All
Click the Empty Selected button
If you are using the Firefox browser:
Click Firefox at the top and choose: Select All
Click the Empty Selected button
NOTE: If you want to keep your saved passwords, click No at the prompt.
If you are using the Opera browser:
Click Opera at the top and choose: Select All
Click the Empty Selected button
NOTE: If you want to keep your saved passwords, click No at the prompt.
Click Exit in the main menu to close the program.
For technical support, double-click the email address located at the bottom of each menu.
__________________________________________________
---> Download ToolCleaner2 to your Desktop.
* Double-click ToolsCleaner2.exe to launch it.
* Click on Search and let the scan run.
* Click on Delete to finish.
* You can, if you wish, use the Optional Features.
* Click on Exit to obtain the report.
* Post the report (TCleaner.txt) found at the root of your hard drive (C:\).
_________________________________________________
manually delete toolscleaner2
________________________________________________
---> Download and install CCleaner (Do not install the Yahoo Toolbar):
* Launch it. Go to Options then Advanced and uncheck the box Clear only files etc....
* Go to Cleaner, choose Analyze. Once done, start the cleaning.
* Then choose Registry, then Search for issues. Once completed, fix all the issues as many times as it finds during the scan (Backup the registry).
* Make sure in the options the setting is at Windows startup and set to "secure deletion" 35 passes (guttman)
__________________________________________________
Attention: do not touch the PC while it is working!
B-Cleaning and Defragmentation of your Disks
*Cleaning:
Right-click on "My Computer" ==>"Open" ==>right-click on drive C ==>Properties ==>tab "General"
Click on the "Disk Cleanup" button, OK
you do this for each of your drives
________________________________________________
*Error checking:
Right-click on "My Computer" ==>"Open" ==>right-click on drive C ==>Properties ==>tab "Tools"
"Check Now", a box opens, check the boxes:
-Automatically fix file system errors...
-Scan for and attempt recovery of bad sectors...
--->Start, OK
Note: if it tells you to restart your PC to do this, restart and let it run, it takes some time, that's normal
you do this for each of your drives
________________________________________________
then still in the same tab you choose:
*Defragmentation:
"Defragment now", OK
a box opens, select the disk to defragment, and click on "Analyze", then after the analysis, "Defragment". OK
you do this for each of your drives
_______________________________________________
Note: if you have a defragmentation utility, use it instead
to do this Defraggler is suggested:
_________________________________________________
> Can you check Java Console? :
, and install the new version if necessary (in that case uninstall the old version first).
For info or in case of problem:
Tutorial
here's how to uninstall:
JavaRa
Extract the file to the Desktop (Right-click > Extract All).
* Double-click on the JavaRa folder.
* Then double-click on the file JavaRa.exe (the exe may not be displayed).
* Choose French and then click on Select.
* Click on Check for updates.
* Select Update via jucheck.exe then click on Search.
* Allow the process to connect if it asks, click on Install and follow the installation instructions which take a few minutes.
* The installation is finished, go back to the JavaRa screen and click on Delete old versions.
* Click Yes to confirm. Let it work and then click OK, then a second time on OK.
* A report will open. Post it in your next response.
* Close the application.
Note: the report is also found in C:\ under the name JavaRa.log.
_________________________________________________
> Update Adobe Reader if not (uninstall before the previous version)
__________________________________________________
> You can also empty your recycle bin, although CCleaner does it automatically
_____________________________________________________
> If we used MalwareByte's Anti-Malware: empty its quarantine.
- Launch the program then click on <Quarantine>.
- Select all items then click on <delete>.
- Exit the program.
______________________________________________________
>if you installed Antivir:
Antivir Configuration (Thanks to Nico):
Right-click on its icon in the taskbar and select Configure Antivir.
check the box: Expert Mode.
=> Click on Scanner in the left pane:
> In "Files" select All files.
> In search procedure, check Allow halt, and in "scanner priority" select High.
> In "Other settings" check all boxes.
DO NOT FORGET TO CHECK FOR ROOTKIT DETECTION WHICH IS VERY IMPORTANT!
=> Click on "Search" in the left pane and apply the same settings as before.
=> Expand "Search" by clicking on the +. Click on "Heuristic":
> Check "MacroVirus Heuristic" and "Win32 file Heuristic" with HIGH identification degree!
=> In the left pane, expand "Guard" then expand "Search":
> Check "MacroVirus Heuristic" and "Win32 file Heuristic" with HIGH identification degree!
________________________________________________________
> Do the same for your antivirus: empty its quarantine if not done already
______________________________________________________
> Disable and re-enable system restore, for that: follow the instructions in the link:
Link XP
Link Vista
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Some advice and recommendations for the future:
> Run MalwareByte's Anti-Malware from time to time (once a week, depending on how you use your PC).
- Also use your other protection software (antivirus scans, antispywares...). Don’t forget to update them before using them.
- Also consider defragmenting your hard drives from time to time (keep enough space on C:\ (1/3 free to be comfortable))
_____________
> To properly protect your PC: [1 Antivirus] + [1 Firewall (/!\ routers and boxes have one)] + [A good Antispyware with immunization] + [Recent Windows and Protection Software Updates] + [Using Firefox -or others- (Internet Explorer has security flaws that take a long time to fix but you must keep it for Windows updates and Windows live Messenger)]
PS: In fact the best protection is you: what you do with your PC: where you surf, download... etc....
Viruses exploit the vulnerabilities of your PC to infect a system
in the wish to uninstall one antivirus in favor of another, here are some links:
Uninstall Antivir
Uninstall Avast
Uninstall BitDefender
Uninstall Norton
Uninstall Kaspersky
Uninstall AVG
or all in one:
Antivirus, Firewall, Antispyware Uninstallation
_____________
>useful link
>SpywareBlaster = small software that blocks the installation of harmful ActiveX to the PC. (Works in the background)
____________
If you have Vista do not forget to reactivate User Account Control (UAC)
___________
If you have Spybot S&D and we disabled the "Tea-timer" you can reactivate it
____________
There you go,
Happy reading, see you soon, once all this is done you can mark the topic as resolved
Gen-hackman
--
®© ----™g3и-н@¢ки™---- ©® -
I'm already posting the ToolsCleaner report
[ ToolsCleaner report version 2.3.2 (by A.Rothstein & dj QUIOU) ]
-->- Search:
C:\_OtMoveIt: found!
C:\Rsit: found!
C:\Documents and Settings\Severine\Desktop\OTMoveIt3.exe: found!
C:\Documents and Settings\Severine\Desktop\Rsit.exe: found!
C:\Program Files\trend micro\HijackThis.exe: found!
C:\Program Files\trend micro\hijackthis.log: found!
---------------------------------
-->- Deletion:
C:\Program Files\trend micro\HijackThis.exe: deleted!
C:\Documents and Settings\Severine\Desktop\OTMoveIt3.exe: deleted!
C:\Documents and Settings\Severine\Desktop\Rsit.exe: deleted!
C:\Program Files\trend micro\hijackthis.log: deleted!
C:\_OtMoveIt: deleted!
C:\Rsit: deleted!
Temporary files cleaned! -
no nothing to do just that the installers have nothing to do in program Files that’s all :)
follow what I asked you please otherwise to keep track it's less obvious already that it's rush hour and we have to satisfy everyone !!
HAHA
:)
--
G3и-н@¢км@и™©® -
Hello,
I have it in the script of my blog.
Do you have any help to offer? I haven't received a response so far.
Thank you -
Thanks again for all the help and I haven't had the time to finish everything yet ;)
However, I found out where this little script blocking issue was coming from (by Avast, actually) a simple WordPress update was all it took for everything to work for everyone... -
-
Can you tell me which antivirus you managed to use to remove the trojan?
-
Good evening,
I had the same problem, and I thought it was coming from Avast...
But check this out:
https://www.wjunction.com/install/index.php?upgrade/
It is indeed a Trojan!
Previous
- 1
- 2