Backdoor Bot MSIL?

Just tried posting the responses but it said:

New members are not allowed to post external links or emails for 7 days. Please contact the forum administrator for more information.

There must be some links in the logs. Remove them and you will be able to post the logs.

# AdwCleaner v3.311 - Report created 30/10/2014 at 22:02:28
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Dave - DAVE-PC
# Running from : C:\Users\Dave\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A1CCCE0D-AE21-42A2-BE58-8E6109410995}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Google Chrome v38.0.2125.111

[ File : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : ASK.COm
Deleted [Search Provider] : usenet-crawler

*************************

AdwCleaner[R0].txt - [1017 octets] - [30/10/2014 20:54:28]
AdwCleaner[S0].txt - [946 octets] - [30/10/2014 22:02:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1005 octets] ##########


Malwarebytes Anti-Malware


Scan Date: 31/10/2014
Scan Time: 07:59:04
Logfile:
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.10.31.03
Rootkit Database: v2014.10.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Dave

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 508728
Time Elapsed: 19 min, 11 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Professional x64
Ran by Dave on 31/10/2014 at  8:29:31.93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31/10/2014 at  8:31:28.17
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



SecurityCheck said "UNSUPPORTED OPERATING SYSTEM"

What Av are you using and is it up-to-date?

Malwarebytes' Anti-Rootkit

Please download Malwarebytes' Anti-Rootkit and save it to your desktop.

• Be sure to print out and follow the instructions provided on that same page for performing a scan.
  
• Caution: This is a beta version so also read the disclaimer and back up all your data before using.
  
• When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
  
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
  
• Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
  
• Copy and paste the contents of these two log files in your next reply.
  

I use Microsoft security essentials.

Ok, could I see the log for MBAM Anti-rootkit.

files attached - it wouldnt let me put the content in here as it said there were URLs in it. But I couldnt find any to remove!

I couldn't open the attachments. Could you try sending them to me in a pm?

Sent, thanks. All looks clean I believe.

That looks good. Let's try another.

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan

•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.

• Leave the check mark next to Remove found threats.
  

•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

running now - 25 mins in so far.

still running - 2 hrs in!

i'll have to post report tomorrow.

Thanks for your help.

It really shouldn't take that long. You may have to stop it and start it again.

C:\Windows\Temp\searchmeToolbar.exe a variant of Win32/Toolbar.Widgi.B potentially unwanted application deleted - quarantined
H:\Gem_Old_Laptop\Users\Gem\AppData\Local\{D44E6646-DFF5-11E1-8270-B8AC6F996F26}\manager.js JS/Redirector.NCG trojan cleaned by deleting - quarantined
H:\Software\windows.7.codec.pack.v4.0.8.setup.exe a variant of Win32/Toolbar.Widgi.B potentially unwanted application deleted - quarantined

Good, how's your computer running now? Any other issues?

Fine - was running fine anyway, it was just that one issue with a file I created in visual studio. I assume in that case it must have been a false positive?

I assume in that case it must have been a false positive?.

At this point, that's what it looks like. Let's clean up.

This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
  
• Remove disinfection tools
  
• Create Registry backup
  
• Purge System Restore Points
  
• Re-set system settings
  

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.
****************************************
Click Start> Computer> right click the C Drive and choose Properties> enter
Click Disk Cleanup from there.



Click OK on the Disk Cleanup Screen.
Click Yes on the Confirmation screen.



This runs the Disk Cleanup utility along with other selections if you have chosen any. (if you had a lot System Restore points, you will see a significant change in the free space in C drive)
****************************************
I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

No worries - will do this as soon as I get home from work.

Thanks very much for your help.

Regards
Dave

All done - and ive installed WOT.

Thanks for your help - good to know I wasnt infected.

I'm pretty good and checking what I'm installing, removing any dodgy add-ons etc.. but you just never know.

Is the process we have gone through worthwhile doing on a regular basis?

Regards
Dave

Thanks for your help - good to know I wasnt infected.

You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.

Is the process we have gone through worthwhile doing on a regular basis?

You may keep MBAM and AdwCleaner and run them on a regular basis.