Hi
Well that has cleaned some of the infection still some bits left to deal with though.
Now we need to stop some running processes which i have in
quote below, using HJT.
C:\WINDOWS\system32\ajbwfehf.exe
HOW TO STOP RUNNING PROCESSES USING HJT
- Open HijackThis.
- Click on the Config button and then click on the Misc Tools button. You should now see a new screen with one of the buttons being Open Process Manager.
- Click on Process Managerbutton. Now you are able to view all running processes on your computer.
- Click once on a process to select it, and then click on the Kill Process button. This will attempt to end the process running on your computer.
- If you would like to terminate multiple processes at the same time, press and hold down the control key on your keyboard. While that key is pressed, click once on each process that you want to be terminated. As long as you hold down the control button while selecting the additional processes, you will be able to select multiple processes at one time. When you have selected all the processes you would like to terminate you would then press the Kill Process button.
- To exit the process manager you need to click on the back button twice which will place you at the main screen.
- Close Hijackthis now.
Upload a File to Virustotal
Please visit
Virustotal
- Copy and Paste the following quotebox into the submit a file box:
C:\WINDOWS\system32\ajbwfehf.exe
- Click the Send button
- Repeat this for the following files as well:
C:\WINDOWS\system32\bezqyosq.exe
C:\WINDOWS\system32\ujfyfsmi.exe
- Copy and paste the results back here please.
Please
download the
OTMoveIt2 by OldTimer.
- Save it to your desktop.
- Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
- Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
C:\WINDOWS\system32\ajbwfehf.exe
C:\WINDOWS\system32\bezqyosq.exe
C:\WINDOWS\system32\ujfyfsmi.exe
- Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
- Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ajbwfehf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\bezqyosq
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ujfyfsmi
- Return to OTMoveIt2, right click in the "Paste Custom List Of Files/Patterns To Move" window (under the yellow bar) and choose Paste.
- Click the red Moveit! button.
- Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
- Close OTMoveIt2
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose
Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter
*.log and press the Enter key, navigate to the
C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
Updating Java:
- Download the latest version of Java(TM) SE Runtime Environment 6u5.
- Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
- Click the "Download" button to the right.
- Check the box that says: "Accept License Agreement".
- The page will refresh.
- Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
- Close any programs you may have running - especially your web browser.
- Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on the download to install the newest version.
mjq424
