Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Threats found after using ESET Online Scan. Trojan


  • Please log in to reply
10 replies to this topic

#1 CashmereCattt

CashmereCattt

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:27 PM

Posted 02 November 2014 - 02:06 PM

I just Ran ESET Online Scan On my Windows 7 machine and it has detected a Win32/Olmarik.AIZ trojan. How do I clean this up? here is a log of the results

 

C:\TDSSKiller_Quarantine\23.10.2014_01.30.07\tdlfs0000\tsk0005.dta    a variant of Win32/Olmarik.AIZ trojan    cleaned by deleting - quarantined
C:\Users\Admin\Downloads\Setup.exe    a variant of Win32/SoftPulse.O potentially unwanted application    deleted - quarantined



BC AdBot (Login to Remove)

 


m

#2 Condobloke

Condobloke

    Outback Aussie @ 54.2101 N, 0.2906 W


  • Members
  • 5,586 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:01:27 PM

Posted 02 November 2014 - 02:40 PM

G'day CashmereCattt, and Welcome to BC.

 

Go to THIS page, click on    [Download Olmarik / Olmasco Cleaner ]

 

Save to your desktop, and then Run the cleaner.

 

(Your computer should be clean anyway because the Online scanner has deleted and quarantined the threat....this will make sure )

 

The second item in your list is only a pup (potentially unwanted program) and has been deleted and quarintined.

 

 

 


Condobloke

Outback Australian  

 

fed up with Windows antics...??

 

LINUX IS THE ANSWER

 

I USE LINUX MINT 18.3  EXCLUSIVELY.

 Failure is not an option. It comes bundled with your Microsoft product.

 

Success is not Final, Failure is not Fatal,

 

It is the Courage to Continue that Counts.

W.C. 4th June 1940

 

 

 


#3 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:27 PM

Posted 02 November 2014 - 02:48 PM

Follow the path....C:\TDSSKiller_Quarantine\.........and delete folder containing the file that was quarantined 10 days ago.

If you uninstall the Eset scanner it should remove the other quarantined file permanently....

 

If you haven't run the below scans...suggest that you do.

 

  • download AdwCleaner by Xplode and save to your Desktop.
  • Double-click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

 

download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Use CCleaner to remove Temporary files, program caches, cookies, logs, etc. Use the Default settings. No need to use the

Registry Cleaning Tool...risky. Pay close attention while installing and UNcheck offers of toolbars...especially Yahoo.

CCleaner - PC Optimization and Cleaning - Free Download


Edited by buddy215, 02 November 2014 - 02:50 PM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#4 CashmereCattt

CashmereCattt
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:27 PM

Posted 02 November 2014 - 03:27 PM

G'day CashmereCattt, and Welcome to BC.

 

Go to THIS page, click on    [Download Olmarik / Olmasco Cleaner ]

 

Save to your desktop, and then Run the cleaner.

 

(Your computer should be clean anyway because the Online scanner has deleted and quarantined the threat....this will make sure )

 

The second item in your list is only a pup (potentially unwanted program) and has been deleted and quarintined.

 

 

 

Thank you for responding and clearing that up for me. Much appreciated



#5 CashmereCattt

CashmereCattt
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:27 PM

Posted 02 November 2014 - 03:29 PM

Thank you buddy215 for helping me out. Here are the log files from the scans

# AdwCleaner v4.002 - Report created 02/11/2014 at 15:11:28
# DB v2014-10-26.6
# Updated 27/10/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Admin - ADMIN-PC
# Running from : C:\Users\Admin\Desktop\AdwCleaner(1).exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v33.0.2 (x86 en-US)


-\\ Google Chrome v38.0.2125.111


*************************

AdwCleaner[R0].txt - [1528 octets] - [22/10/2014 21:01:05]
AdwCleaner[R1].txt - [1024 octets] - [22/10/2014 23:43:49]
AdwCleaner[R2].txt - [1023 octets] - [23/10/2014 13:38:32]
AdwCleaner[R3].txt - [1236 octets] - [29/10/2014 11:03:33]
AdwCleaner[R4].txt - [1329 octets] - [02/11/2014 15:08:31]
AdwCleaner[S0].txt - [1487 octets] - [22/10/2014 21:06:40]
AdwCleaner[S1].txt - [1081 octets] - [22/10/2014 23:46:32]
AdwCleaner[S2].txt - [1295 octets] - [29/10/2014 11:15:33]
AdwCleaner[S3].txt - [1245 octets] - [02/11/2014 15:11:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1305 octets] ##########

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.5 (10.31.2014:1)
OS: Windows 7 Home Premium x64
Ran by Admin on Sun 11/02/2014 at 15:16:45.83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\68d64s40.default\minidumps [5 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Admin\appdata\local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 11/02/2014 at 15:22:46.40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 



#6 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:27 PM

Posted 02 November 2014 - 04:15 PM

The two deleted extensions are from Hola.

Any other problem?


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#7 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:27 PM

Posted 02 November 2014 - 04:26 PM

Those programs removed the same extension. You might want to rerun either after another reboot or tomorrow

and if that extension exists you can try a reset of Google Chrome.

 

Google Chrome gives you the option to reset your browser settings in one easy click. In some cases, programs that you install can change your Chrome settings without your knowledge. You may see additional extensions and toolbars or a different search engine. Resetting your browser settings will reset the unwanted changes caused by installing other programs. However, your saved bookmarks and passwords will not be cleared or changed.

Reset your browser settings
  1. In the top-right corner of the browser window, click the Chrome menu
  2. Select Settings.
  3. At the bottom, click Show advanced settings.
  4. Under the section "Reset settings,” click Reset settings.
  5. In the dialog that appears, click Reset.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#8 CashmereCattt

CashmereCattt
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:27 PM

Posted 03 November 2014 - 12:07 PM

I ran both tools and they didn't pull up anything. As far as the scans go, looks all clear. Thank you so much for your time and help!

 

The only issues i'm having at the moment are BSOD after running my VPN. Im using OpenVPN this error message pops up after the reboot:

 

Problem Event Name:    BlueScreen
  OS Version:    6.1.7601.2.1.0.768.3
  Locale ID:    1033

Additional information about the problem:
  BCCode:    50
  BCP1:    FFFFF88006363578
  BCP2:    0000000000000000
  BCP3:    FFFFF88003E04585
  BCP4:    0000000000000000
  OS Version:    6_1_7601
  Service Pack:    1_0
  Product:    768_1

Files that help describe the problem:
  C:\Windows\Minidump\110314-21590-01.dmp
  C:\Users\Admin\AppData\Local\Temp\WER-45786-0.sysdata.xml



#9 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:27 PM

Posted 03 November 2014 - 12:42 PM

You would likely get an answer concerning the blue screen by posting a new topic in the Windows 7 forum. 


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#10 CashmereCattt

CashmereCattt
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:10:27 PM

Posted 03 November 2014 - 01:10 PM

I'll post something there then. Sorry for the mixup.

 

Is there anything else I should do?



#11 buddy215

buddy215

  • BC Advisor
  • 12,616 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:27 PM

Posted 03 November 2014 - 01:36 PM

No, nothing else....you've solved the issue you were concerned about. Hope someone has a solution for

the bsod.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users