Author Topic: Avira found a trojan and then found it 5 more times - TR/Dldr.FraudLoad.zkth  (Read 1097 times)

0 Members and 2 Guests are viewing this topic.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
And then there is my saved instructions ;) :

Uninstalling older versions of JRE may not uninstall the Java Console for that version, causing Firefox to accumulate multiple Java Console extensions located in the Firefox > Tools > Add-ons list.
  • Make sure you already have the most recent version, Java SE Runtime Environment 6u26.
  • Go to C:\Program Files > Mozilla Firefox > extensions.
  • Delete the folders "{CAFEEFAC-0016-0000-xxxx-ABCDEFFEDCBA}", where xxxx is the number of the JRE-version.  Keep the highest number as this is the latest version, in this case 0027.

In your case the files to remove would be the following:

{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
As long as you're updating, you might as well get the latest release of Flash Player.

Apparently a compatibility update for "Debugger (aka debug players or content debuggers) and Standalone (aka Projectors) Players for Flex and Flash developers"
08/24/2011 - Updated debugger (aka debug players or content debuggers) and standalone (aka projector) versions of Flash Player 10.3 are available for Flash Builder, Flash Catalyst, and Flash Professional users. These players contain fixes for critical vulnerabilities identified in Security Bulletin APSB11-21. All users are encouraged to update to the new players. These new players are version 10.3.183.7.

Direct download for IE:  http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player_ax.exe

Direct Download for non-IE (Opera, Firefox etc): http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe

After install, verify Flash Player version for each browser installed at About Flash Player page.
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Thanks.   Flash is  updated and consoles cleaned out.   I didnt' delete the latest Java console(27) but If its incompatible with FF6 anyway, I suppose I could delete that too.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
You could, although I decided to wait since the JRE6u27 console is disabled in Firefox. 
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Is it safe to delete the quarantined malware files and also delete the setup.exe from the old hard drive? 
They won't get together and plan a reunion in my recycle bin, will they?

Actually, I would like to delete everything in the olddrive folder...all the old files--including program and windows files were copied over to my new comuputer (this on) by the tech that set it up for me.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
Yes, it is safe to delete the quarantined files.  As to cleaning up the olddrive folder, use the Disk Cleanup tool which helps you free up space on your hard disk by searching your disk for files that you can safely delete. You can choose to delete some or all of the files.  It can also be used to clear all but the most recent System Restore point.

First, create a fresh restore point:

1.  Click Start, click All Programs, click Accessories, click System Tools, and then click System Restore.
2.  Click Create a Restore Point, and then click Next.
3.  Name your restore point. (i.e., clean)
4.  Click the Create button.
5.  When the new restore point has been created, click Close.

Now select the files to be removed as well as all but the new restore points:
  • Click start-->Run and type cleanmgr into the run box and then click "OK".
  • Select the drive where Windows is installed (if you have more than one drive) and click "OK".
  • When the scan completes, check/uncheck desired boxes.
  • Next, please click the More Options tab at the top.
  • Click the "Clean up..." button under the System Restore section at the bottom.
  • Answer Yes to the question "Are you sure you want to delete all but the most recent restore point?".
  • Click OK and answer Yes again.
The disk clean up utility will remove the selected items.  When it completes, please restart the computer to properly record the changes made to the hard disk.
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
ok.. so

how will I know what is safe to delete from the olddrive folder?

Will the computer stop me if  try to delete something that is needed?

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Well. I messed up royally.  I thought I would be able to try deleting some folders and restore them if it didn't work.  Apparently I was wrong.

I deleted the the whole folder containing the exe  from the olddrive file.  Then I ran disk clean up again.  But I didn't let it clean the recycle bin, thankfully.

I rebooted and Windows could not find my profile to sign me in.  So I rebooted again in safe mode and restored the two files I had sent to the recycle bin  (The file 'C:\olddrive\Documents and Settings\Administrator\Desktop\Dean's\setup.exe---I got rid of the folder "Desktop" and 'the other folder was a Favorites folder under "Admnistrator", I believe).  However on another reboot, I got the same message, but Windows offered me two login accounts...my name, and Administrator.  When I clicked my name, nothing happened.  So I clicked the Administrator one.  It did sign me in but with a barebones desktop and no access to my files on my harddrive.  The message said it was creating a temporary profile that would be erased when I rebooted.

My husband said not to try anything more, but wait for the computer tech to call back.

So that is where I am now. Typing from that administrator account.  *sigh*  I think this is the worst I have ever messed up.


Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
The following was composed prior to your last reply:
Quote
Actually, I would like to delete everything in the olddrive folder...all the old files--including program and windows files were copied over to my new comuputer (this on) by the tech that set it up for me.
If it is just a folder rather than Windows.old that was created by the tech, you should be able to delete it manually.

As to the Disk Cleanup tool is not a third-party program.  It is integrated in the operating system.  The files presented will be safe to remove.  See this Microsoft KB article for additional information:  Description of the Disk Cleanup Tool in Windows XP.

Follow-up:

I cannot begin to guess how the tech set up your computer if you are logging on from the files copied from your old computer.  See what s/he says when returning your call.
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
ok. I am totally rejoicing.

I talked to the tech and he told me the computer does not boot from the olddrive files and that deleting and restoring those files from the olddrive folder had nothing to do with what happened. He said I should be able to delete anything from that folder with no issues.

He said likely some process corrupted my information, and that can happen from improper shut downs over time and a bunch of other factors.  He suggested a system restore..but that did nothing since I didn't have a restore point from before today.

He said I would have to find and move all my files to the administrator account and set everything up again.  But..he said...let's try ONE more thing.... run checkdisk.   After 3 hours of scanning, checkdisk found  this:
Stage 4:
Found and replaced bad clusters in File 127907 of \Docume-\Helena\NTUSER DAT.

and when it rebooted, everything was back!  yay!

This is the first and only time I've ever run checkdisk on this computer.  I tried once before but it stopped me partway through asking for the CD or the location of the installation CD info.  The CD made for me did not work, and I could not locate the file on my computer...so it never went farther than that.

So anyway, nice to know that I didn't cause this problem, something just glitched.  I do have to shut down my computer by turning off the powerstrip occassionallly (because it won't shut down even from the button on the tower), so maybe that contributed to today's drama.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11530
  • "Stronger than the past, united in our goal."
    • Security Garden
Good news.  NTUSER DAT is the "user profile" so that being corrupt explains completely what happened.   Hopefully chkdsk also fixed the shutdown problem.  If not, when it happens the next time, see if you can launch Task Manager and look at the running processes to see if an application that you use is not ending gracefully.

,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
I think that maybe it did fix something on the shut-down/reboot cycle, because when I had to boot up afterwards, the button on the tower turned the computer on for the first time in ages  (although I had to hold it in about 3 seconds before it activated).

Haven't tried to shut down after that yet, so we'll see how that goes.

I'll remember about checking task manager.