Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ninite defraggler essentials malwarebytes installer.exe


  • Please log in to reply
3 replies to this topic

#1 GollyGee

GollyGee

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:29 PM

Posted 10 January 2015 - 06:42 PM

This has infected a machinewhich used the Ninite utility to install various software programs recently. While I would like to think its not Ninite that is the problem, I would like to verify what could be the source on the trojan that has now infected my computer, and what I can do to prevent it from happening again....
Some information received and links so far.
http://www.tweakmysystem.com/fixerror-exe/ninite+defraggler+essentials+malwarebytes+installer.exe.html
http://www.highpcspeed.com/errors-exe/ninite+avast+malwarebytes+spybot+installer.exe.html

Edited by Queen-Evie, 10 January 2015 - 07:44 PM.
moved from Windows 7 to the appropriate forum


BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • BC Advisor
  • 13,006 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:12:29 AM

Posted 10 January 2015 - 07:28 PM

Disregard all instructions and info given in the two links you posted.

 

CCleaner - PC Optimization and Cleaning - Free Download

Download and install CCleaner. Pay close attention during install and UNcheck offers of toolbars...especially Google.

No need to use the Registry Cleaner....risky. Use the default settings. Open CCleaner and click on the button at the bottom

right to Run Cleaner.

Open CCleaner and choose tools. Click on Uninstall. On that page you will see a list of programs installed on your computer.

At the bottom right you will see a button when clicked will allow you to Copy and Paste that list into your next post. Please do that.

 

Open MBAM, update it, run a scan using the settings below and post the log in your next post.

  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • The scan may take some time to finish,so please be patient.
  • If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.
  • download AdwCleaner by Xplode and save to your Desktop.
  • Double-click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Hold down Control and click on this link to open ESET OnlineScan in a new window. (Eset can take more than an hour to run so plan accordingly)

  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the esetsmartinstaller_enu.png icon on your desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under scan settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
  • Scan potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
  • NOTE:Sometimes if ESET finds no infections it will not create a log.

Edited by buddy215, 10 January 2015 - 07:35 PM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#3 GollyGee

GollyGee
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:29 PM

Posted 13 January 2015 - 05:40 AM

Hi BC advisor,

All operations completed satisfactorily.

Here are the files you wished to look at:

Eset had already been used previously as had CCleaner.

The final Eset scan was clear.

Things are now normal.

But the only thing I am concerned about was the fact that this was a clean protected machine which was somehow infected mysteriously

Ninite installer was used and when the user called me next it had become infected......

It makes me worry if ninite had somehow been hijacked or they are using the installer in some nefarious way....

John

 

# AdwCleaner v4.107 - Report created 13/01/2015 at 20:59:08
# Updated 07/01/2015 by Xplode
# Database : 2015-01-13.2 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Cheryl - CHERYL-PC
# Running from : C:\Users\Cheryl\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\ParetoLogic
Folder Deleted : C:\Users\Cheryl\AppData\Roaming\ParetoLogic
Folder Deleted : C:\Users\Cheryl\AppData\Roaming\pdfforge

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v34.0.5 (x86 en-US)


-\\ Google Chrome v39.0.2171.95


*************************

AdwCleaner[R0].txt - [308 octets] - [13/01/2015 20:37:34]
AdwCleaner[R1].txt - [1013 octets] - [13/01/2015 20:55:56]
AdwCleaner[S0].txt - [942 octets] - [13/01/2015 20:59:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1001 octets] ##########
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Cheryl on Tue 01/13/2015 at 21:16:59.17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 01/13/2015 at 21:28:29.22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 



#4 buddy215

buddy215

  • BC Advisor
  • 13,006 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:12:29 AM

Posted 13 January 2015 - 08:08 AM

Repeat........

Open CCleaner and choose tools. Click on Uninstall. On that page you will see a list of programs installed on your computer.

At the bottom right you will see a button when clicked will allow you to Copy and Paste that list into your next post. Please do that.

 

I don't suspect Ninite being responsible for whatever adware/ malware was found. I suspect downloading some free app or browser add-on

to be responsible. If ninite was being used to update the programs it installed, then I don't suspect those programs of installing adware

during updating. But some add-ons and programs do attempt to install adware during updates.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users