Infected with grayware?

[enyal]

Hi,

1) I think I am lost.

2) HijackThis is sitting on my Desktop. I open it. I find Misc Tools. I find Uninstall Manager and Save List.

3) I end up on a Config window with a window titled "Save Add/Remove
Software to Disk...

4) Is this where I should be?

5) I have before used HighJackThis and copied the log, and sent it to Cybertech. Is this what I am suppose to do?

Enyal

[Jintan]

3) I end up on a Config window with a window titled "Save Add/Remove
Software to Disk...

And now you have lost me. Not real sure how you got from saving the uninstall list to that, or what caused it. You clicked Save List, and then that popped up?

[enyal]

Hi, this is what I did:

1) Clicked HERE and a Cybertech "Self extracting HiJackThis installer page appeared.

2) Clicked first line "Download Self Extracting HiJackThis Installer Now!" and "Download" box popped up.

3) Clicked "Save File" and HiJackThis short cut icon showed up on the desktop.

4) Clicked Icon and a "Trend Micro HiJackThis" window opens showing a list titled "What would you kike to do?"

5) Clicked "Open Misc Tools Section" and a "Configuration " file opens showing "System Tools"

6) Clicked "Open Uninstall Manager" under "System Tools" and a window inside that window opens to the right showing things like Adobe Flash Player, File Uploader, Java, Malewarebytes, Microsoft Visual C++ Open Office, Nikon Transfer, etc, etc.

7) Clicked "Save List" in the mid-lower right of the file and a "Save Add/Remove Software To Disk..." file shows up with a file name at the bottom of "Uninstall List"

Enyal

[Jintan]

Okay, if I understand that correctly, save it to somewhere other than a disk, like your desktop. Just browse to aim it where you want it.

[enyal]

Hi,

1) Following is the Uninstall List from HijackThis program:


Uninstall List taken from HiJackThis, that
Cybertech Tech ask me to send, August, 24, 2012


Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4)
ESET Online Scanner v3
File Uploader
HijackThis 2.0.2
Java(TM) 6 Update 33
Java(TM) 7 Update 5
JavaFX 2.1.1
Malwarebytes Anti-Malware version 1.62.0.1300
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 14.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nikon Message Center
Nikon Transfer
OpenOffice.org 3.3
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
TeamViewer 7
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
VIPRE Antivirus
VIPRE Antivirus
Windows Media Player Firefox Plugin

[Jintan]

Quite a minimal install list. Other than that "File Uploader", which sounds questionable but could be okay, the only suggestion is to remove that older, more vulnerable Java(TM) 6 Update 33 (leave the latest, 7 Update 5).

Looking okay now. Before we do some final cleaning up steps here, how are things running?

[enyal]

Hi Tom,

1) I removed the Java 6.

2) I noted that the "File Uploader" is related to my Nikon still camera.

3) A short time after I got the new Computer and Operating System earlier this year, I downloaded off the Wet the Nikon Transfer software.

4) Is this uploader still needed to upload pictures to emails, etc?

5) The computer seems to be running okay.

6) Is there any reason to look at the HijackThis log to see if there are any "bad guys" lurking there?

7) Regarding the support of Cybertech resubscribed about a year ago---can't remember exactly---and also a subscription for my wife. Is there a record at Cybertech of the subscriptions anniversaries. I intend to continue to support Cybertech!

Enyal

[Jintan]

All sounds good, honestly. No need to check further. We removed all that needed removing, and of course, that "File Uploader" is a legit program. I'll check with the CTH Administrator about the subscription question though.

System is running good, and I see now other issues. Ready to have us do the cleaning up of what our work added there now?

[MishY]

Originally Posted by enyal

7) Regarding the support of Cybertech resubscribed about a year ago---can't remember exactly---and also a subscription for my wife. Is there a record at Cybertech of the subscriptions anniversaries. I intend to continue to support Cybertech!

Hi Enyal

Unfortunately I'm not aware that there is a way for you to see such anniversaries, and thank you for your support

[Jintan]

Thanks Mishy. Enyal - System is running good, and I see now other issues. Ready to have us do the cleaning up of what our work added there now?

[enyal]

Hi,

1) I have been away for a few days.

2) Thank you for the help!

3) Is there any thing else we need to do?

Enyal

[Jintan]

Hope your travels went well. Just some last steps to remove what our work added there.


Eset, if you don't plan to use it again, uninstalls through the Control Panel - Programs and Features.

--------

Go to Start Search, type cmd.exe in the Start Search box. Cmd.exe will appear at the top of the Menu. Rightclick on it and choose "Run as administrator". At the prompt copy/paste the following, pressing Enter after each:

cd "%userprofile%\desktop"

combofix /uninstall

ComboFix should uninstall itself at this time.

-----

You can also at this time delete the files/folders of the tools we used. To assist with some of that run OTL again. This will help by automatically removing some of the tools we used.

Just click CleanUp, and select Yes. When it finishes removing some of the tools and files we used there just agree to the reboot.

-------

In addition, I like to recommend reviewing the information Here to make sure you stay malware free.

[enyal]

Hi,

1) Thank you for your help!

2) Even though I am a subscriber, I will be sending a contribution to Cybertech.

Enyal

[Jintan]