View original (French)

How to remove the Capricornus virus

Solved
AwWenN Posted messages 13 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello, I have a small problem on my browser, I tried to download an ISO file of Windows 7 but it contained a virus (Capricornus). I’ve been trying for a month to remove this adware with AdwCleaner, Malwarebytes, etc. but these programs don’t detect any adware. I’d like to know how to remove this virus without resetting my PC. Thanks in advance

6 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hi,

    You have installed adware and spyware on your PC that open advertisements and slow down the computer and web browsers.
    Here is the procedure to follow to remove them:

    Start with this:

    Follow the AdwCleaner tutorial (by Xplode)
    This program helps remove adware and spyware:
    • Download it to your desktop or Downloads folder.
    • Run AdwCleaner, click [Scanner].
    • The scan can take several minutes, please wait.
    • Once the scan is finished, do not uncheck anything, click [Clean]
    • Once the cleanup is finished, a report will open. Copy/paste the contents of the report in your next reply by copy/paste.


    If that doesn’t work, use the site http://pjjoint.malekal.com to host the report, provide the link to the report in a new message.
    Note: The report is also saved at C:\AdwCleaner[S1].txt

    then:

    Follow the FRST tutorial.
    (and take time to read carefully to apply correctly - everything is explained).
    Download and run the FRST scan, this will generate three FRST reports:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send, as explained, these three reports to the site http://pjjoint.malekal.com and in return provide the three pjjoint links that lead to these reports here in a new reply so that we can review them.

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
    1. AwWenN Posted messages 13 Status Member
       
      AdwCleaner v5.023 - Report created on 2015-12-05 at 13:21:54
      Updated on 2015-11-30 by Xplode
      Database: 2015-12-03.1 [Server]
      Operating system: Microsoft Windows XP Service Pack 3 (x86)
      Username: Administrator - ACER
      Launched from: F:\Documents and Settings\Administrateur\Mes documents\Téléchargements\adwcleaner_5.023.exe
      Option: Clean
      Support: https://toolslib.net/forum
              • [ Services ] *****
              • [ Dossiers ] *****
              • [ Fichiers ] *****


      [-] Removed File: F:\Documents and Settings\All Users\Application Data\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
              • [ DLLs ] *****


      [!] Non-Disinfected File: F:\WINDOWS\system32\dnsapi.dll
              • [ Shortcuts ] *****
              • [ Scheduled tasks ] *****
              • [ Registry ] *****


      [-] Deleted Key: HKLM\SOFTWARE\Microsoft\ESENT\Process\SnapDo
      [-] Deleted Key: HKCU\Software\Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}
      [-] Deleted Key: HKLM\SOFTWARE\Classes\CLSID\{B33BD6CF-BF4C-4CF0-AC84-B2974BC14ABD}
      [-] Deleted Key: HKLM\SOFTWARE\Classes\Interface\{94952EC4-DB66-3F32-BE4C-F0BB875EA98E}
      [-] Deleted Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{444785F1-DE89-4295-863A-D46C3A781394}
      [-] Deleted Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{444785F1-DE89-4295-863A-D46C3A781394}
      [-] Deleted Key: HKCU\Software\360
              • [ Browsers ] *****


                  :: Deleted "Tracing" Keys
                  :: Winsock settings reset

                  ########## EOF - F:\AdwCleaner\AdwCleaner[C5].txt - [1607 bytes] ##########
      0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Download & extract the vbates.zip archive
    2. Temporarily disable your antivirus protection
    3. Then run dnsapero.exe as Administrator
    4. A report will open in Windows Notepad
    5. Copy / Paste the contents into your forum topic

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
    1. AwWenN Posted messages 13 Status Member
       
          • DnsApero v1.0.2 by w00t ***

      >> http://forum.malekal.com/
      [+] Recherche... F:\WINDOWS\System32\dnsapi.dll
      [!] Infection détectée
      [%] Corrections...

      [+] Vérifications...
      Sf:\windows\system32\dnsapi.dll:
      Verified: Signed
      Signing date: 08:00 03/03/2011
      Publisher: Microsoft Windows Component Publisher
      Description: DNS Client API DLL
      Product: Microsoft® Windows® Operating System
      Prod version: 5.1.2600.6089
      File version: 5.1.2600.6089 (xpsp_sp3_gdr.110302-1625)
      MachineType: 32-bit
      Binary Version: 5.1.2600.6089
      Original Name: dnsapi
      Internal Name: dnsapi
      Copyright: © Microsoft Corporation. All rights reserved.
      Comments: n/a
      Entropy: 6.669
      MD5: D76A076ADB74F8132924E498D63123A2
      SHA1: 89F7FF0775B85FD76F01D0D08EEF488CD2D3AFF0
      PESHA1: 95C867350043E99B79B75341F12DB15A2840790C
      PE256: n/a
      SHA256: D784D16EB8284667F0C6FAD441C7519E2DC389F2D0C88C3E9EC75A0E203C62CA
      0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    It seems correct.
    The Capricornus ads, on which web browser do you have them?

    Can you run the FRST scan to see as requested in the first message: https://forums.commentcamarche.net/forum/affich-32863990-comment-supprimer-le-virus-capricornus#1

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
  4. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    It looks like your Windows is cracked :)
    You’ve got stuff running that shouldn’t.

    You should uninstall all IOBit programs, they’re useless and justeat resources.

    Here is the correction to perform with FRST.
    You can refer to this explanatory note with screenshots to help you: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

    Open Notepad: Windows key + R, in the Run box, type notepad and OK.
    Copy/paste the following into it:

    2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () F:\Documents and Settings\Administrateur\Application Data\cEu0Ze67
    2014-06-13 16:48 - 2014-06-13 16:48 - 0000036 _____ () F:\Documents and Settings\Administrateur\Application Data\DOK52P4Q3J.dat
    2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () F:\Documents and Settings\Administrateur\Application Data\GY1MxWo6jZQpX
    2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () F:\Documents and Settings\Administrateur\Application Data\NHmZgfDfqEeFBM0
    2014-09-02 09:24 - 2014-09-02 09:24 - 0000036 _____ () F:\Documents and Settings\Administrateur\Application Data\SuYZkvrV.tmp
    2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () F:\Documents and Settings\Administrateur\Application Data\v8y84S6nAUbe691UbAO8Cvwfaa
    2015-11-14 14:34 - 2015-11-14 14:34 - 00000187 _____ F:\Documents and Settings\Administrateur\Local Settings\Application Data\Reit.exe.config
    2015-11-14 14:54 - 2015-11-14 14:54 - 00000000 ____D F:\Documents and Settings\LocalService\Application Data\MediaStreamingService
    2015-11-14 14:53 - 2015-11-23 11:43 - 00001074 _____ F:\WINDOWS\Tasks\NHmZgfDfqEeFBM0.job
    2015-11-14 14:53 - 2015-11-23 11:43 - 00001070 _____ F:\WINDOWS\Tasks\GY1MxWo6jZQpX.job
    2015-11-14 14:53 - 2015-11-20 23:03 - 00000000 ____D F:\Documents and Settings\Administrateur\Local Settings\Application Data\8722A94D-2FC0-44AC-87DB-A8DF1985849C
    2015-11-14 14:42 - 2015-11-23 11:43 - 00001096 _____ F:\WINDOWS\Tasks\v8y84S6nAUbe691UbAO8Cvwfaa.job
    2015-11-14 14:42 - 2015-11-23 11:43 - 00001060 _____ F:\WINDOWS\Tasks\cEu0Ze67.job
    HKU\S-1-5-18\...\RunOnce: [Del6393312] => cmd.exe /Q /D /c del F:\WINDOWS\TEMP\0.del <===== ATTENTION
    HKU\S-1-5-18\...\RunOnce: [Del5513000] => cmd.exe /Q /D /c del F:\WINDOWS\TEMP\0.del <===== ATTENTION
    HKU\S-1-5-18\...\RunOnce: [Del5554203] => cmd.exe /Q /D /c del F:\WINDOWS\TEMP\0.del <===== ATTENTION
    Task: F:\WINDOWS\Tasks\cEu0Ze67.job => F:\Documents and Settings\Administrateur\Application Data\cEu0Ze67.exe <==== ATTENTION
    Task: F:\WINDOWS\Tasks\GY1MxWo6jZQpX.job => F:\Documents and Settings\Administrateur\Application Data\GY1MxWo6jZQpX.exe <==== ATTENTION
    Task: F:\WINDOWS\Tasks\NHmZgfDfqEeFBM0.job => F:\Documents and Settings\Administrateur\Application Data\NHmZgfDfqEeFBM0.exe <==== ATTENTION
    Task: F:\WINDOWS\Tasks\v8y84S6nAUbe691UbAO8Cvwfaa.job => F:\Documents and Settings\Administrateur\Application Data\v8y84S6nAUbe691UbAO8Cvwfaa.exe <==== ATTENTION

    Once the text is pasted into Notepad.
    File menu then Save As.
    On the left, go to Desktop.
    In the box at the bottom, file name set: fixlist.txt
    Click Save - this will create a fixlist.txt file on the desktop.

    Relaunch FRST and click the Fix button.
    Depending on the situation a restart may be required (not mandatory).
    A text file appears, copy/paste its contents here in a new message.

    Restart the computer

    then reset your browsers:
    ==================================
    Reset your browsers and/or manually reconfigure your web browsers (startup page, search engine etc) but also remove/disable unnecessary/parasite extensions:

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
    1. AwWenN Posted messages 13 Status Member
       
      Farbar Recovery Scan Tool results (x86) Version: 05-12-2015 Ran by Administrator (2015-12-05 13:59:47) Run: 1 Started from F:\Documents and Settings\Administrator\Desktop Loaded profiles: Administrator (Available: Administrator) Boot mode: Normal ============================================== fixlist contents: - (empty list; structure shown but no actionable items) 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () F:\Documents and Settings\Administrateur\Application Data\cEu0Ze67 2014-06-13 16:48 - 2014-06-13 16:48 - 0000036 _____ () F:\Documents and Settings\Administrateur\Application Data\DOK52P4Q3J.dat 2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () F:\Documents and Settings\Administrateur\Application Data\GY1MxWo6jZQpX 2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () F:\Documents and Settings\Administrateur\Application Data\NHmZgfDfqEeFBM0 2014-09-02 09:24 - 2014-09-02 09:24 - 0000036 _____ () F:\Documents and Settings\Administrateur\Application Data\SuYZkvrV.tmp 2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () F:\Documents and Settings\Administrateur\Application Data\v8y84S6nAUbe691UbAO8Cvwfaa 2015-11-14 14:34 - 2015-11-14 14:34 - 00000187 _____ F:\Documents and Settings\Administrateur\Local Settings\Application Data\Reit.exe.config 2015-11-14 14:54 - 2015-11-14 14:54 - 00000000 ____D F:\Documents and Settings\LocalService\Application Data\MediaStreamingService 2015-11-14 14:53 - 2015-11-23 11:43 - 00001074 _____ F:\WINDOWS\Tasks\NHmZgfDfqEeFBM0.job 2015-11-14 14:53 - 2015-11-23 11:43 - 00001070 _____ F:\WINDOWS\Tasks\GY1MxWo6jZQpX.job 2015-11-14 14:53 - 2015-11-20 23:03 - 00000000 ____D F:\Documents and Settings\Administrateur\Local Settings\Application Data\8722A94D-2FC0-44AC-87DB-A8DF1985849C 2015-11-14 14:42 - 2015-11-23 11:43 - 00001096 _____ F:\WINDOWS\Tasks\v8y84S6nAUbe691UbAO8Cvwfaa.job 2015-11-14 14:42 - 2015-11-23 11:43 - 00001060 _____ F:\WINDOWS\Tasks\cEu0Ze67.job HKU\S-1-5-18\...\RunOnce: [Del6393312] => cmd.exe /Q /D /c del F:\WINDOWS\TEMP\0.del <===== ATTENTION HKU\S-1-5-18\...\RunOnce: [Del5513000] => cmd.exe /Q /D /c del F:\WINDOWS\TEMP\0.del <===== ATTENTION HKU\S-1-5-18\...\RunOnce: [Del5554203] => cmd.exe /Q /D /c del F:\WINDOWS\TEMP\0.del <===== ATTENTION Task: F:\WINDOWS\Tasks\cEu0Ze67.job => F:\Documents and Settings\Administrateur\Application Data\cEu0Ze67.exe <==== ATTENTION Task: F:\WINDOWS\ Tasks\GY1MxWo6jZQpX.job => F:\Documents and Settings\Administrateur\Application Data\GY1MxWo6jZQpX.exe <==== ATTENTION Task: F:\WINDOWS\Tasks\NHmZgfDfqEeFBM0.job => F:\Documents and Settings\Administrateur\Application Data\NHmZgfDfqEeFBM0.exe <==== ATTENTION Task: F:\WINDOWS\Tasks\v8y84S6nAUbe691UbAO8Cvwfaa.job => F:\Documents and Settings\Administrateur\Application Data\v8y84S6nAUbe691UbAO8Cvwfaa.exe <==== ATTENTION
        ... (list of nested empty items) ...
      F:\Documents and Settings\Administrateur\Application Data\cEu0Ze67 => moved successfully F:\Documents and Settings\Administrateur\Application Data\DOK52P4Q3J.dat => moved successfully F:\Documents and Settings\Administrateur\Application Data\GY1MxWo6jZQpX => moved successfully F:\Documents and Settings\Administrateur\Application Data\NHmZgfDfqEeFBM0 => moved successfully F:\Documents and Settings\Administrateur\Application Data\SuYZkvrV.tmp => moved successfully F:\Documents and Settings\Administrateur\Application Data\v8y84S6nAUbe691UbAO8Cvwfaa => moved successfully F:\Documents and Settings\Administrateur\Local Settings\Application Data\Reit.exe.config => moved successfully F:\Documents and Settings\LocalService\Application Data\MediaStreamingService => moved successfully F:\WINDOWS\Tasks\NHmZgfDfqEeFBM0.job => moved successfully F:\WINDOWS\Tasks\GY1MxWo6jZQpX.job => moved successfully F:\Documents and Settings\Administrateur\Local Settings\Application Data\8722A94D-2FC0-44AC-87DB-A8DF1985849C => moved successfully F:\WINDOWS\Tasks\v8y84S6nAUbe691UbAO8Cvwfaa.job => moved successfully F:\WINDOWS\Tasks\cEu0Ze67.job => moved successfully HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\Del6393312 => value deleted successfully HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\Del5513000 => value deleted successfully HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\Del5554203 => value deleted successfully F:\WINDOWS\Tasks\cEu0Ze67.job => not found. F:\WINDOWS\Tasks\GY1MxWo6jZQpX.job => not found. F:\WINDOWS\ Tasks\NHmZgfDfqEeFBM0.job => not found. F:\WINDOWS\Tasks\v8y84S6nAUbe691UbAO8Cvwfaa.job => not found.

      Fin de Fixlog 13:59:47

      And by the way, I don’t know if my Windows is cracked, but I had to repair my hard drive because it was failing, so the technician probably reinstalled another Windows than my old Vista.
      0
  6. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Voici la traduction française fidèle, en conservant le format HTML et les balises éventuelles: ça donne quoi ?

    --
    Comme l’ange que tu es, tu rises en apportant une légèreté dans ma poitrine,
    Tes yeux me transpercent,
    (Ta réponse est toujours « peut-être »)
    C’est alors que je me suis levé et que je suis parti
    0
    1. AwWenN Posted messages 13 Status Member
       
      It worked successfully, I no longer have this darn extension. Thank you very much.
      0
  7. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    =)

    Voila, c'est terminé, tu peux supprimer les programmes utilisés.

    Quelques conseils :

    Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=

    Pour ne plus te faire avoir.
    A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/
    (Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)

    Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0