Is Nodejs.exe a virus?

Hi,

Follow the FRST tutorial. ( take your time to read carefully - everything is well explained ).

Download and run the FRST scan, 3 FRST reports will be generated:

• FRST.txt
• Shortcut.txt
• Additionnal.txt

Send these 3 reports to the website http://pjjoint.malekal.com/ and return the 3 pjjoint links leading to the reports here in a new response so that we can consult them.

--
Please press any key to continue the disinfection...

I don't see Nodejs.exe
and nothing malicious in the reports.

--
Please press any key to continue the disinfection...

Where is this Nodejs.exe located?
Do you have the path in the registry?
Or did you search on the disk?

This scheduled task seems a bit suspicious:

Task: {96670AAE-B80B-4A8E-B924-1BF3D6968A61} - System32\Tasks\{642AFBC8-89E4-9BB5-6F79-313B32068856} => C:\Users\ffame\AppData\Roaming\Boken\SYNCVE~1.EXE [2013-05-07] ()

What is in this folder C:\Users\ffame\AppData\Roaming\Boken\?

--
Please press any key to continue the disinfection...

ok it's a mess.

Here is the correction to be made with FRST. You can use this explanatory note with screenshots.

Open Notepad: Windows Key + R,
In the "Run" field, type notepad and hit OK.
Copy/Paste the following into it:

CreateRestorePoint:
CloseProcesses:
CreateRestorePoint:
Task: {96670AAE-B80B-4A8E-B924-1BF3D6968A61} - System32\Tasks\{642AFBC8-89E4-9BB5-6F79-313B32068856} => C:\Users\ffame\AppData\Roaming\Boken\SYNCVE~1.EXE [2013-05-07] () 
 C:\Users\ffame\AppData\Roaming\Boken
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:

Once the text is pasted into Notepad,
Menu "File" then "Save As",

On the left, go to the Desktop,

In the bottom field, enter the file name: fixlist.txt
Click on "Save", this will create fixlist.txt on the Desktop.

Restart FRST and click on the "Fix" button
A restart may be necessary (not mandatory)
A text file will appear, copy/paste the content here in a new message.

Restart the computer.

--
Please press any key to continue the disinfection...