Such files (were marked by ESET scanner) are elements of your incremental backup system and probably contain a real infections.I:\WD SmartWare.swstor\OWNER-PC\Volume.31c3bf67.fd27.11e2.a5e5.4c72b92e3e25\Downloads\Flight zips\F1Download.zip a variant of Win32/Packed.Themida potentially unwanted application
I:\WD SmartWare.swstor\OWNER-PC\Volume.31c3bf67.fd27.11e2.a5e5.4c72b92e3e25\Downloads\Flight zips\F1Download@ac77a5bd24774e3bb2cc91e910b44622.zip a variant of Win32/Packed.Themida potentially unwanted application
I:\WD SmartWare.swstor\OWNER-PC\Volume.31c3bf67.fd27.11e2.a5e5.4c72b92e3e25\Downloads\Flight zips\F1Download@c3e6b12db1b449a2847aee302d04d765.zip a variant of Win32/Packed.Themida potentially unwanted application
I:\WD SmartWare.swstor\OWNER-PC\Volume.31c3bf67.fd27.11e2.a5e5.4c72b92e3e25\Laptop 091610\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\jojlg90v.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\chrome\iobitcom.jar Win32/Toolbar.Conduit.A potentially unwanted application
I:\WD SmartWare.swstor\OWNER-PC\Volume.31c3bf67.fd27.11e2.a5e5.4c72b92e3e25\Laptop 091610\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\jojlg90v.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\chrome\iobitcom@c8ceff39c00943d59089a510d7a48a90.jar Win32/Toolbar.Conduit.A potentially unwanted application
This set of files looks like manual backup but potential problems are the same.I:\Passport Backup\Downloads\filehelper_setup_docx.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
I:\Passport Backup\Downloads\Flight zips\F1Download.zip a variant of Win32/Packed.Themida potentially unwanted application
I:\Passport Backup\Downloads\Flight zips\FSHost\PFPortChecker.exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
I:\Passport Backup\Laptop 091610\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\jojlg90v.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}\chrome\iobitcom.jar Win32/Toolbar.Conduit.A potentially unwanted application
I:\Passport Backup\Laptop 091610\Users\Owner\Downloads\asc-setup(2).exe Win32/Toolbar.Conduit.A potentially unwanted application
I:\Passport Backup\MGtools\Process.exe Win32/PrcView potentially unsafe application
Except for all "I:\..." files from the ESET list your computer is clean. My opinion is that potentially infected files, especially inside of backup must be removed, but the final decision is yours. I could recommend to delete the whole backup and start the new fresh one - now when your computer is clean it is a good starting point.
In such case, I will delete it with other files below.Only problem I had was D:\Program Files\Microsoft Games\Microsoft Flight Simulator X\SimObjects\Airplanes\Unused Aircraft\Flight1 1 ATR72\Flight1 ATR 72-500.rar was too large to upload for a scan. It is not a critical file for me so I can simply delete if that is ok.
Step 1.
OTL - Run Fix Script
You should still have OTL.exe on your desktop.
Important! Close all applications and windows so that you have nothing open and are at your Desktop.
- Right click on OTL.exe, select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
- Underneath Output at the top, make sure Standard Output is selected.
- Highlight and copy the following entries: into the
text box.
(Do not include the words Code: Select all - instead of it please click the Select all button next to Code: to select the entire script.)- Code: Select all
:Commands [createrestorepoint] :Files D:\Program Files\Microsoft Games\Microsoft Flight Simulator X\SimObjects\Airplanes\Unused Aircraft\Flight1 1 ATR72\Flight1 ATR 72-500.rar H:\Downloads\Flight zips\F1Download.zip H:\Downloads\Flight zips\FSHost\PFPortChecker.exe H:\Downloads\Flight zips\EzDok\EZCA-Update-1.16.zip :Commands [emptytemp]
- Click under the Custom Scan/Fixes box and paste the copied text.
- Click the Run Fix button. If prompted... click OK.
- OTL may ask to reboot the machine. Please do so if asked.
- Let the program run unhindered and reboot the PC when it is done.
When the computer reboots, and you start your usual account, a Notepad text file will appear - close it.
Your latest set of logs appear to be clean!
![cheers :cheers:](./images/smilies/icon_cheers.gif)
This is my general post for when your logs show no more signs of malware.
Before I give you instructions how to keep your computer clean and secure, you need to make a few additional steps.
Step 2.
OTL - Run Script
You should still have OTL on your desktop.
Important! Close all applications and windows so that you have nothing open and are at your Desktop.
- Right click on OTL.exe, select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
- Copy and Paste the following code into the
text box.
(Do not include the words Code: Select all - instead of it please click the Select all button next to Code: to select the entire script.)- Code: Select all
:Commands [CREATERESTOREPOINT] :Commands [EMPTYTEMP] [CLEARALLRESTOREPOINTS]
- Click under the Custom Scan/Fixes box and paste the copied text.
- Click the Run Fix button. If prompted... click OK.
- OTL may ask to reboot the machine. Please do so if asked.
Step 3.
OTL-Cleanup
You should still have OTL on your desktop.
- Right click on OTL.exe, select "Run As Administrator..." to run it. If prompted by UAC, please allow it.
- Press the CleanUp button.
- When done, you will be prompted to reboot your system to finish file removal, please select OK to reboot your computer.
Step 4.
Hide Hidden and System files
- Close all programs so that you are at your desktop.
- Press
.
- Click the Start Search box on the Start Menu
- Copy and paste the following value, in the open text entry box:
change search options for files and folders - Click on the View tab, then under the "Hidden files and folders" section
- UNSELECT "Show hidden files and folders"
- Place check mark in check box "Hide extensions for known file types"
- Place check mark in check box "Hide protected operating system files"
- Press the Apply, then the OK buttons.
Step 5.
Please download delfix and save it to your desktop.
- Right-click on delfix.exe and select " Run as administrator " to run it.
- Check the following boxes then click on Run.
- Activate UAC
- Remove disinfection tools
- Create registry backup
- Purge system restore
- Reset system settings
- All tools we used to clean your computer should be gone now.
- You can now delete any tools/logs we used if they remain on your computer.
Step 6.
You can now delete any tools/logs we used if they remain on your Desktop.
Please don't forget to enable and update all your defense software!
Then:
Computer free from infections is very good, but in your case the problem does not stop there. The fact that the "Blue Screen" has not yet appeared is not mean anything. The problem related to the main hard drive of your machine - Check Disk Utility as well as Event Viewer reported about multiple errors and instability, but it is not for our forum any more.
I strongly recommend you to get technical help for your not related to malware problems and would like to refer you to a technical support forum like: Tech Support Guy.
Feel free to refer to this topic for any reason.
Finally:
Please click HERE to find a short guide to staying safer online.
Please don't hesitate to ask any additional questions.
Stay Safe!
![Wink ;)](./images/smilies/icon_wink.gif)
pgmigg