Can't remove Win32.FraudLoad.edt

[km2357]

Step # 1 Update Adobe Acrobat Reader

There is a newer version of Adobe Acrobat Reader available. (See Note below)

• First, go to Add/Remove Programs and uninstall Adobe Reader X (10.0.1).
• Please go to this link Adobe Acrobat Reader Download Link
• On the right Untick McAfee® Security Scan Plus if you do not wish to include this in the installation.
• Click the Continue button
• Click Run, and click Run again
• Next click the Install Now button and follow the on screen prompts

Note: Adobe Reader X (10.1.0) is a large program and if you prefer a smaller program you can get Foxit 5.0.0 instead from http://www.foxitsoftware.com/downloads/index.php

If you decide to install Foxit 5.0.0 instead of Adobe, do the following during Foxit's Setup/Installation process:

Uncheck the following boxes:

I accept the License Terms and want to install Foxit Toolbar

Make Ask.com my default search

Create desktop, quick launch and start menu icon to eBay



ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan.
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!



In your next post/reply, I need to see the following:

1. ESET Log
2. How is your computer doing, any problems?

[Erik S]

It's a bit funny 'cause at the moment when I read your reply, I was downloading Adobe Reader already How's my computer doing? Doing fine, 'cause I take regular care of it (virus/spyware scans, defrags, keeping it clean, etc...). There used to be a Windows Update problem, but I got it solved after reinstalling .net packs. But I've had couple of problems for unknown time (maybe for 4-6 months).

1. Windows startup problem:
a) System boots just fine.
b) I log in as an administrator (inserting password and pressing enter).
c) Welcome screen is seen (with no logon sound heard).
d) Content of explorer.exe is seen (desktop and taskbar).
--With exception that the taskbar is only partially seen (most of it is covered with dark blue color) for first two seconds (probably system is loading it).
e) Everything is frozen (since the desktop and taskbar appeared) for 10-20 seconds. No programs seem to load, taskbar is also frozen (unable to click the start button and the notification area is empty). I'm able to move my cursor though.
f) After 10-20 seconds, Windows logon sound is heard, icons appear to notification area, but when I move my cursor to taskbar, it turns to hourglass. After five seconds I'm able to use taskbar normally.

This problem also occurs with imited user, but delay is very small (for 0.5 seconds instead of 10-25 seconds). I've tried to disconnect from network before startup, but it didn't help. Also, I've tried to open task manager to see if any process even load while freezing takes place, but it didn't open. Normal startup is selected in msconfig, and I've also refreshed boot.ini (but I think it has nothing to do with startup). Maybe some startup process is causing that, but there are damn too many out there and it would take a while to test every one of them (also I have no I idea if there's a point to). It's not very annoying and I can live with it. --Almost forgot to add that sometimes when logged in as an administrator, the delay is also only 0.5 seconds long as with limited user.

2. DVD reading issue
Sometimes the ODD (DVD writer) is unable to read DVD-s, but most of times it's able to. When it's able to, still there is one DVD that can't be read (AoE Collector's Edition). That DVD can only be read if inserted BEFORE startup or boot. Unfortunately I have no other ODD (DVD one) to replace it with to test if it's system's problem or ODD's. This occurs with all users. I've also uninstalled a driver from device manager to let Windows automatically reinstall it, but it didn't help.


Somehow I think these problems are connected to each other because both occur randomly (if logged in with administrator, delay might be different every time).

Eset Online Scanner log:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=eba5bf6f18ffc042acc8282ff6f20cf4
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-13 06:22:55
# local_time=2011-07-13 09:22:55 (+0200, FLE Daylight Time)
# country="Estonia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2304 16777215 100 0 0 0 0 0
# compatibility_mode=5891 16776869 42 87 1364 22628839 0 0
# compatibility_mode=8192 67108863 100 0 1156 1156 0 0
# scanned=82380
# found=4
# cleaned=0
# scan_time=4201
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentbm10.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentbm8.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentbm9.zip Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Erik\Application Data\Sun\Java\Deployment\cache\6.0\7\143b51c7-1e12f5e2 a variant of Java/TrojanDownloader.OpenStream.NCC trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok

[km2357]

For the first problem, you can try the tips at the following website to see if they help:

http://www.malwareremoval.com/tutori...ningslowly.php


If the delay is not a hinderance and you say that you can live with it, we could also just leave it alone as well.


For the 2nd problem, since it just happens with the Age Of Empires DVD you can try asking at an AoE forum. They'd be better equipped/able to answer your question than I would.

http://forum.agecommunity.com/forums...ShowForum.aspx

You may need to register at the AoE forum first before you can ask your question(s) there.



I'd like for you to do the following:


Step # 1 Clear Java's Cache

Click Start > Control Panel

• Double-click the Java icon in the control panel. (coffeecup icon)
• Click Settings under Temporary Internet Files.
  
  -The Temporary Files Settings dialog box appears.
  
  
• Click Delete Files.
  
  -The Delete Temporary Files dialog box appears.
  -There are two options on this window to clear the cache.
  
  
• Applications and Applets
• Trace and Log Files

Make sure both are checked

Click OK on Delete Temporary Files window.

-Note: This deletes all the Downloaded Applications and Applets from the cache.

Click OK on Temporary Files Settings window.
Close the Java Control Panel


Finally, I'd like for you to do a scan with Spybot S&D. If you don't have the latest version of Spybot (the latest version is 1.6.2), then uninstall Spybot S&D from your computer and download the latest version from the following website:

http://www.safer-networking.org/en/mirrors/index.html

Once you do have the latest version of Spybot, update it so that you have the latest database and do a scan with it. Let me know if Spybot finds/fixes anything and if it does, post the Spybot log in your next post/reply.

[Erik S]

Nice! I did the Spybot scan and it only found one Right Media cookie spyware, no Win32.FraudLoad.edt. Looks like the spyware is gone and we are done with it (Or are we?). Anyway if we are, I have nothing left to do than thanking you for taking your time and helping removing this spyware. Also, is it recommended to do regular scans with Malwarebytes'? It seemed to find some spyware that spybot didn't.

SB log:

Right Media: Jälgimise küpsis (Internet Explorer: Erik) (Küpsis, fixed)

(Küpsis means cookie)

[km2357]

Looks like the spyware is gone and we are done with it (Or are we?)

I don't see any more spyware/malware on your computer. And if there are no more problems, then we're good to go.

Also, is it recommended to do regular scans with Malwarebytes'? It seemed to find some spyware that spybot didn't.

I'd do a scan with MalwareBytes' every 2 weeks or so, just be sure that it is updated before you do the scan.



You can delete the following off of your computer:


DDS.scr
The two DDS Logs
GMER.zip
GMER.exe
The GMER Log


To remove ComboFix, do the following:

Go to Start > Run - type in ComboFix /Uninstall & click OK


Empty your Recycle Bin.


Please take the time to read my All Clean Post.

Please follow these simple steps in order to keep your computer clean and secure:

This is a good time to clear your existing system restore points and establish a new clean restore point

• Go to Start > All Programs > Accessories > System Tools > System Restore
• Select Create a restore point, and Ok it.
• Next, go to Start > Run and type in cleanmgr
• Make sure the C:\ drive is selected and click OK. If your computer's Hard Drive is not located on C:, change it to the correct drive letter then click OK.
• Select the More options tab
• Choose the option to clean up system restore and OK it.
• This will remove all restore points except the new one you just created.

.

Clearing your restore points is not something you should do on a regular basis. Normally, this process only needs to be done after clearing out an infestation of malware.


Make your Internet Explorer more secure This can be done by following these simple instructions:

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
   
   • Change the Download signed ActiveX controls to Prompt
   • Change the Download unsigned ActiveX controls to Disable
   • Change the Initialize and script ActiveX controls not marked as safe to Disable
   • Change the Installation of desktop items to Prompt
   • Change the Launching programs and files in an IFRAME to Prompt
   • Change the Navigate sub frames across different domains to Prompt
5. When all these settings have been made, click on the OK button.
6. If it asks you if you want to save the settings, press the Yes button.
7. Next press the Apply button and then the OK to exit the Internet Properties page.

Set correct settings for files that should be hidden in Windows XP

• Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
• Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
• If unchecked please checkHide protected operating system files (Recommended)
• If necessary check "Display content of system folders"
• If necessary Uncheck Hide file extensions for known file types.
• Click OK

• Use An Antivirus Software and Keep It Updated - It is very important that your computer has an antivirus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a day. If you do not update your antivirus software, then it will not be able to catch any of the new variants that may come out.
• Visit Microsoft's Update Site Frequently It is important that you visit Microsoft Updates regularly. This will ensure your computer has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
• Install SpywareBlaster SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. You can find SpywareBlaster here:
  SpywareBlaster
• Use the hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate web pages. We can customize a hosts file so that it blocks certain web pages. However, it can slow down certain computers. This is why using a hosts file is optional. Download mvps hosts file Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  
  1. Click the start button on the task bar at the bottom of your screen
  2. Click run
  3. In the dialog box, type services.msc
  4. hit enter, then locate dns client
  5. Highlight it, then doubleclick it.
  6. On the dropdown box, change the setting from automatic to manual.
  7. Click ok..
• Use an alternative instant messenger program.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
• Please read Tony Klein's excellent article: How I got Infected in the First Place
• Please read Understanding Spyware, Browser Hijackers, and Dialers
• Please read Simple and easy ways to keep your computer safe and secure on the Internet
• If you are using Internet Explorer, please consider using an alternate browser: Mozilla's Firefox or
  Opera.
  If you decide to use either FireFox or Opera, it is very important that you keep them up to date and check frequently for updates of the browser of your choice.
• Update all these programs regularly Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Here's a good website to read about Malware prevention:

http://users.telenet.be/bluepatchy/m...revention.html


Good luck!

Please reply one last time so that I know you have read my post and this thread can be closed.

[Erik S]

I've read your post and this threat can be closed

[km2357]

I'm glad I was able to help you out.

Good luck and safe surfing!


Since this issue appears to be resolved ... this Topic has been closed. Glad we could
help.

Note: If it has been three days or more since your last post, and the helper assisting
you posted a response to that post to which you did not reply, your topic will not be
reopened. At that point, if you still require help, please start a new topic and include
a fresh DDS log and a link to your previous thread.

If it has been less than three days since your last response and you need the thread
re-opened, please send me or your helper a private message (pm). A valid, working link to
the closed topic is required.