Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

dropbox.exe virus


  • Please log in to reply
23 replies to this topic

#16 Broni

Broni

    The Coolest BC Computer


  •  Avatar image
  • Helper Emeritus
  • 42,964 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Krakow, Poland
  • Local time:01:04 AM

Posted 14 December 2014 - 04:27 PM

p22002970.gif Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

p22002970.gif Please download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.


p22002970.gif Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.


p22002970.gif Download Sophos Free Virus Removal Tool and save it to your desktop.
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program


My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 

BC AdBot (Login to Remove)

 


#17 Bob99

Bob99
  • Topic Starter

  •  Avatar image
  • Members
  • 19 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Copperas Cove, TX
  • Local time:06:04 PM

Posted 14 December 2014 - 05:21 PM

# AdwCleaner v4.105 - Report created 14/12/2014 at 15:44:21
# Updated 08/12/2014 by Xplode
# Database : 2014-12-13.4 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Bob - DESKTOP-1
# Running from : C:\Users\Bob\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Bob\AppData\Roaming\Solvusoft

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v34.0 (x86 en-US)


*************************

AdwCleaner[R0].txt - [2844 octets] - [15/11/2014 14:51:02]
AdwCleaner[R1].txt - [3196 octets] - [23/11/2014 17:59:32]
AdwCleaner[R2].txt - [1044 octets] - [14/12/2014 15:42:46]
AdwCleaner[S0].txt - [2686 octets] - [15/11/2014 14:53:07]
AdwCleaner[S1].txt - [3186 octets] - [23/11/2014 18:00:59]
AdwCleaner[S2].txt - [969 octets] - [14/12/2014 15:44:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1028 octets] ##########
 

Rkill 2.6.8 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/14/2014 02:29:14 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * C:\Windows\jmesoft\Service.exe (PID: 2108) [WD-HEUR]
 * C:\Windows\jmesoft\hotkey.exe (PID: 5060) [WD-HEUR]
 * C:\Windows\jmesoft\JME_LOAD.exe (PID: 4688) [WD-HEUR]

3 proccesses terminated!

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * No issues found.

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * Cannot edit the HOSTS file.
 * Permissions Fixed. Administrators can now edit the HOSTS file.

 * HOSTS file entries found:

  127.0.0.1    www.007guard.com
  127.0.0.1    007guard.com
  127.0.0.1    008i.com
  127.0.0.1    www.008k.com
  127.0.0.1    008k.com
  127.0.0.1    www.00hq.com
  127.0.0.1    00hq.com
  127.0.0.1    010402.com
  127.0.0.1    www.032439.com
  127.0.0.1    032439.com
  127.0.0.1    www.0scan.com
  127.0.0.1    0scan.com
  127.0.0.1    1000gratisproben.com
  127.0.0.1    www.1000gratisproben.com
  127.0.0.1    1001namen.com
  127.0.0.1    www.1001namen.com
  127.0.0.1    100888290cs.com
  127.0.0.1    www.100888290cs.com
  127.0.0.1    www.100sexlinks.com
  127.0.0.1    100sexlinks.com

  20 out of 15494 HOSTS entries shown.
  Please review HOSTS file for further entries.

Program finished at: 12/14/2014 02:29:57 PM
Execution time: 0 hours(s), 0 minute(s), and 42 seconds(s)
 

Sophos - No Threats



#18 Broni

Broni

    The Coolest BC Computer


  •  Avatar image
  • Helper Emeritus
  • 42,964 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Krakow, Poland
  • Local time:01:04 AM

Posted 14 December 2014 - 05:41 PM

You posted rKill log instead of JRT log.


My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 

#19 Bob99

Bob99
  • Topic Starter

  •  Avatar image
  • Members
  • 19 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Copperas Cove, TX
  • Local time:06:04 PM

Posted 14 December 2014 - 05:43 PM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Home Premium x64
Ran by Bob on Sun 12/14/2014 at 15:35:46.83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Bob\AppData\Roaming\mozilla\firefox\profiles\qgj0x7nj.default\prefs.js

user_pref("services.sync.passwords.syncID", "LNA8HLaSV9Rx");
Emptied folder: C:\Users\Bob\AppData\Roaming\mozilla\firefox\profiles\qgj0x7nj.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 12/14/2014 at 15:39:41.43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 



#20 Broni

Broni

    The Coolest BC Computer


  •  Avatar image
  • Helper Emeritus
  • 42,964 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Krakow, Poland
  • Local time:01:04 AM

Posted 14 December 2014 - 07:00 PM

How is computer doing?


My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 

#21 Bob99

Bob99
  • Topic Starter

  •  Avatar image
  • Members
  • 19 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Copperas Cove, TX
  • Local time:06:04 PM

Posted 14 December 2014 - 08:56 PM

Seems to be just fine, just finishing up my weekly backup.  I noticed on one of the reports there were a lot of errors reported, was wondering if that's anything to be concerned about.  I feel it may be safe to do my taxes on this thing although I have a laptop I just finished putting a new HD in and haven't installed much else.  How do you feel about the results?



#22 Broni

Broni

    The Coolest BC Computer


  •  Avatar image
  • Helper Emeritus
  • 42,964 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Krakow, Poland
  • Local time:01:04 AM

Posted 14 December 2014 - 10:04 PM

Every computer has some errors so as long as your computer feels fine you're fine.

 

Your computer is clean p3879546.jpg

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download 51a5ce45263de-delfix.pngDelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

  • Activate UAC (optional; some users prefer to keep it off)
  • Remove disinfection tools
  • Create registry backup
  • Purge System Restore
  • Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly ((you need to redownload these tools since they were removed by DelFix))

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry3187642


My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 

#23 Bob99

Bob99
  • Topic Starter

  •  Avatar image
  • Members
  • 19 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Copperas Cove, TX
  • Local time:06:04 PM

Posted 14 December 2014 - 10:42 PM

Thank you very much Broni.  I really appreciate your help.  I am feeling much better about this computer now, it's newer and faster than the old laptop and I probably wouldn't have bought it if I knew how easy it was to fix the old one.

Donation follows, I'm retired and not rich, but want to give something.

Bob



#24 Broni

Broni

    The Coolest BC Computer


  •  Avatar image
  • Helper Emeritus
  • 42,964 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Krakow, Poland
  • Local time:01:04 AM

Posted 14 December 2014 - 10:44 PM

Thank you very much :)

 

Good luck!


My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users