BleepingComputer.com: Exploit:Win32/Pdfjsc.HS

Sorry it's taken me so long to reply! I updated Adobe and Java and deleted earlier versions. I ran both a Malware and MS Safety Scanner. The Malwarebytes was clean, but the MS safety scanner detected and deleted Exploit:Java\cvf.2010-0840.HI. I am including the malwarebytes log and the safety scanner log.

Malwarebytes log:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7702

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/12/2011 6:03:35 PM
mbam-log-2011-09-12 (18-03-33).txt

Scan type: Full scan (C:\|)
Objects scanned: 387821
Time elapsed: 2 hour(s), 5 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





MS Safety Scanner log:Microsoft Safety Scanner v1.0, (build 1.111.2065.0)
Started On Mon Sep 12 20:08:34 2011

Extended Scan Results
----------------
->Scan ERROR: resource file://C:\hiberfil.sys (code 0x00000020 (32))
->Scan ERROR: resource file://C:\hiberfil.sys (code 0x0000054F (1359))
->Scan ERROR: resource file://C:\pagefile.sys (code 0x00000020 (32))
->Scan ERROR: resource file://C:\pagefile.sys (code 0x0000054F (1359))
->Scan ERROR: resource file://C:\hiberfil.sys (code 0x00000020 (32))
->Scan ERROR: resource file://C:\pagefile.sys (code 0x00000020 (32))
Threat detected: Exploit:Java/CVE-2010-0840.HI
containerfile://C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\43\48b7af6b-2462259d
file://C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\43\48b7af6b-2462259d->tools/Commander.class
SigSeq: 0x0000108022D26285
SHA1: E2CAC43972735084DD54D20280BE38CF92A30CEA

Extended Scan Removal Results
----------------
Start 'remove' for file://\\?\C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\43\48b7af6b-2462259d->tools/Commander.class
Operation succeeded !


Results Summary:
----------------
Found Exploit:Java/CVE-2010-0840.HI and Removed!
Microsoft Safety Scanner Finished On Tue Sep 13 07:22:58 2011


Return code: 6 (0x6)

Return code: 4 (0x4)

Return code: 4 (0x4)

Hopefully, everything looks good. I very much appreciate your help with this! I was ready to throw the computer away (or at least out the window).

Hi, that looks good indeed!
Lets do one last scan.

ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on this link to open ESET OnlineScan in a new window.
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the
    icon on your desktop.
  
  
• Check "YES, I accept the Terms of Use."
  
• Click the Start button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check "Scan Archives" and "Remove found threats"
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, click List Threats
  
• Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Click the Back button.
  
• Click the Finish button.

Hi there -
I am not having any luck getting the scanner to run. Everytime I click on "agree" and "start," the computer puts me in a "recovery tab" loop. I'm not sure how to bypass that. I have the firewall and antivirus turned off. Thanks, Sue

Since you already ran the MS safety scanner, I think you should be fine. I wanted to run this scan only to doublecheck, but its not worth the effort to get it to work.

ALL CLEAN
--------------
Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean

Please do the following to remove the remaining programs from your PC:

• Delete the tools used during the disinfection:
  • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.

Please read these advices, in order to prevent reinfecting your PC:

• Install and update the following programs regularly:
  • an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.
    A comprehensive tutorial and a list of possible firewalls can be found here.
    
  • an AntiVirus Software
    It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    
  • an Anti-Spyware program
    Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
    SUPERAntiSpyware is another good scanner with high detection and removal rates.
    Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    
  • Spyware Blaster
    A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
  
  
• Keep Windows (and your other Microsoft software) up to date!
  I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.
  Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
  
• Keep your other software up to date as well
  Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.
  
• Stay up to date!
  The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

• Miekies' prevention suggestions
  
• So How did I get infected?
  
• Microsoft - 'Security at home'
  
• Calendar of Updates: See which updates have been released.
  
• How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail
  
• Commonly Used Freeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.
  
• osalt: Find (free) open source alternatives to known commercial software.

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

I had one more quick question - I have gotten a few pop-ups that are asking me if I want to install adobe flash player. Do you know why I am getting them? This started after I update Adobe reader and deleted old files. Should I let it install or not? I am not sure what is prompting it. Thanks again, Sue

Hi Sue, this is legit, Adobe flash checks for updates on startup and will ask you at every reboot until you either decline or install the update (I got one myself too this week ).

Elsie-
Just wanted to thank you so much for your help (and patience) in getting my computer well again! I have read your "all clean" post and I think I am all set. Thanks again for your help! Over and Out, Sue

You are most welcome!

This topic will now be closed. If you need it reopened, please send me a PM.