"pc health kit" malware? - Overclock.net - An Overclocking Community

Forum Jump: 

"pc health kit" malware?

Reply
 
Thread Tools
post #1 of 17 (permalink) Old 05-02-2013, 07:05 AM - Thread Starter
New to Overclock.net
 
deezdrama's Avatar
 
Join Date: Jan 2010
Location: il
Posts: 421
Rep: 2
My pc had a clean install of windows 7 pro a week ago.

Was on the net using firefox and when updating java this damn pc health kit got installed somehow.

I always use the custom option and uncheck everything bundled with stuff when installing but didnt see anything about pc heath kit.

Im pretty sure its that same old anoying malware prog that tells u your pc is infected and wants money to fix it.

I remember it was a pain to remove on a buddies system years ago.

Tried a sys restore , failed.

Any way to remedy this besides windows reinstall?

Thanks
deezdrama is offline  
Sponsored Links
Advertisement
 
post #2 of 17 (permalink) Old 05-02-2013, 07:18 AM
New to Overclock.net
 
Join Date: Apr 2009
Location: Cincinnati Ohio
Posts: 4,402
Rep: 172
Malwarebytes can likely remove it or Superantispyware.

Alternatively if you like doing it the hands on way a lot of these malwares are cookie cutter variants that can be removed relatively easily. BUsy at work, but if you would like to do it that way, I can write up a quick check to tell let you know how.

Don't just reformat, troubleshoot it first! A lot of problems can be resolved faster than a backup, reformat, reinstall if you put a little thought into troubleshooting.
Ever Evolving
(18 items)
CPU
Phenom II 1090T Black Edition
Motherboard
Gigabyte GA-890FXA-UD5
GPU
Diamond R9 280X
GPU
XFX R9 280X
RAM
Crucial Ballistix Sport 16GB VLP DDR3 1600 CL9 1.35v
Hard Drive
Vertex 3 120GB SSD
Hard Drive
2x WD 1TB Caviar Black SATA3
Hard Drive
WD Caviar Black 640GB SATA2
Optical Drive
HP DVD-RW 1170i
Power Supply
Corsair HX1000W
Cooling
Prolimatech Megahalem
Cooling
2x Delta AFB1212SHE
Cooling
7x Cooler Master SickleFlow R4 fans
Case
Cooler Master HAF932 (Fan Mod)
Operating System
Windows 10 Professional
Monitor
2x Samsung SyncMaster E2420 23.6" 1920x1080
Keyboard
Logitech G15
Mouse
Logitech MX310
▲ hide details ▲
NameUnknown is offline  
post #3 of 17 (permalink) Old 05-02-2013, 07:25 AM - Thread Starter
New to Overclock.net
 
deezdrama's Avatar
 
Join Date: Jan 2010
Location: il
Posts: 421
Rep: 2
Its crazy, I avoid downloading on the net unless its a known source or a tested torrent but with this... all I did was update java through firefox and now without my knowing have

Pc health kit
IMinent
And Sendori installed on my machine.

AVG doesnt pick up on it, system restore failed and removing through the control panel just causes uninstaller to freeze.

I feel like an @$$ for even allowing this crap to get installed, just dont understand how it happened with a java update
deezdrama is offline  
Sponsored Links
Advertisement
 
post #4 of 17 (permalink) Old 05-02-2013, 07:26 AM
New to Overclock.net
 
Join Date: Apr 2009
Location: Cincinnati Ohio
Posts: 4,402
Rep: 172
Eh, changed my mind, I'm gonna write it up anyway smile.gif

Like I was saying, a lot of these malware are cookie cutter, they take the same core virus, change the GUI and a bit of code so that it can slip by updated virus definitions because its something new. Why write something new if you can modify it and make it work again? Anyways, due to this fact its a lot of the rogue AV malware stores itself in the same locations. I am not familiar with the specific one you refer to but this is what I would check first if I were working on it and wanted to remove it the hands on way.

Go into your C:\Users\youruseraccountname\appdata\local\ & C:\Users\youruseraccountname\appdata\Roaming\ & C:\Progam Data\

In these three directories you are likely to find executables with random characters for names (8-10 characters normally) that were created at the time you got the infection on your PC.

If you dont find anything in these locations press Windows+R to launch the run window and type msconfig. Go under the Startup tab and remove any malicious entries and entries you just dont want. These are all programs that run on startup and you can remove whatever you like from being on startup that you see here.

IF msconfig wont launch, boot into safemode and then do everything above. Doing the above steps will get you to the point where you can scan be assured you are removing the virus.

OH I forgot to mention, if you cannot scan or delete the files in the above directories, you will need to do everything i said in safemode. Also, when/if you delete the files you should do Shift+Delete to permanently delete them so they don't just sit in your recycling bin for ages tongue.gif


Everything I've said here is pretty quick and dirty and low risk but should be plenty effective. I'll watch the thread throughout the day if you have any questions or trouble with it.




Edit: If I get enough free time here today I'll do some research on the specific things you've named and see what I can find.

Don't just reformat, troubleshoot it first! A lot of problems can be resolved faster than a backup, reformat, reinstall if you put a little thought into troubleshooting.
Ever Evolving
(18 items)
CPU
Phenom II 1090T Black Edition
Motherboard
Gigabyte GA-890FXA-UD5
GPU
Diamond R9 280X
GPU
XFX R9 280X
RAM
Crucial Ballistix Sport 16GB VLP DDR3 1600 CL9 1.35v
Hard Drive
Vertex 3 120GB SSD
Hard Drive
2x WD 1TB Caviar Black SATA3
Hard Drive
WD Caviar Black 640GB SATA2
Optical Drive
HP DVD-RW 1170i
Power Supply
Corsair HX1000W
Cooling
Prolimatech Megahalem
Cooling
2x Delta AFB1212SHE
Cooling
7x Cooler Master SickleFlow R4 fans
Case
Cooler Master HAF932 (Fan Mod)
Operating System
Windows 10 Professional
Monitor
2x Samsung SyncMaster E2420 23.6" 1920x1080
Keyboard
Logitech G15
Mouse
Logitech MX310
▲ hide details ▲
NameUnknown is offline  
post #5 of 17 (permalink) Old 05-02-2013, 07:27 AM
New to Overclock.net
 
Dctr's Avatar
 
Join Date: Dec 2012
Location: Tasmania, Australia
Posts: 575
Rep: 21
Install Hitmanpro or Malwarebytes and use their trial versions. It sounds to me like some form of adware but it could be a rogue. Do some scans and report back.

http://www.malwarebytes.org/

http://www.surfright.nl/en

Dctr is offline  
post #6 of 17 (permalink) Old 05-02-2013, 07:28 AM
It's a me
 
Jayjr1105's Avatar
 
Join Date: Sep 2010
Location: Central Pennsylvania
Posts: 2,868
Rep: 134
Go into safe mode and try uninstalling it there. If that doesn't work, try revo-uninstaller from normal mode. If that still doesn't work, run Combofix and Malwarebytes from safe mode. Otherwise, you're probably going to have to reinstall. Also, make sure you don't have an infected flash drive or portable device.

Official Delidded Crewman
The Ivy STABLE Club
Nvida GTX960 Owners Club
Raspberry Pi Owners Club
I <3 Mechanical KeyboardCPU Journey (Click to show)
Celeron 333MHz > Pentium 4 2.4GHz > Athlon XP 2800+ > Athlon 64 3400+ > Athlon II X2 250 > Athlon II X4 640 > Phenom II X4 840 > i5 2500K > i7 3770K
Jayjr1105 is offline  
post #7 of 17 (permalink) Old 05-02-2013, 07:31 AM - Thread Starter
New to Overclock.net
 
deezdrama's Avatar
 
Join Date: Jan 2010
Location: il
Posts: 421
Rep: 2
When hitting alt ctrl del durring frozen uninstaller it stated iminent was uninstalled, it then let me uninstall the others but only after reboot.

Does these seem like malware or another threat or just bundled bs that comes with java?

Is there a good freeware program I can use to make sure everythings clean?

Thanks again
deezdrama is offline  
post #8 of 17 (permalink) Old 05-02-2013, 07:35 AM
New to Overclock.net
 
Join Date: Apr 2009
Location: Cincinnati Ohio
Posts: 4,402
Rep: 172
Quote:
Originally Posted by Jayjr1105 View Post

Go into safe mode and try uninstalling it there. If that doesn't work, try revo-uninstaller from normal mode. If that still doesn't work, run Combofix and Malwarebytes from safe mode. Otherwise, you're probably going to have to reinstall. Also, make sure you don't have an infected flash drive or portable device.

Combofix is a great tool as well but reinstalling is unnecessary for the malware on his computer. These aren't the hardcore viruses of old, most rogue AVs are no more then 5-6 files in the appdata directories and occasionally Program Data.

EDIT:
Quote:
Originally Posted by deezdrama View Post

When hitting alt ctrl del durring frozen uninstaller it stated iminent was uninstalled, it then let me uninstall the others but only after reboot.

Does these seem like malware or another threat or just bundled bs that comes with java?

Is there a good freeware program I can use to make sure everythings clean?

Thanks again

I'd scan it with Malwarebytes even though they say they are gone. A quick google shoes IMinent & Sendori are often viruses.

Don't just reformat, troubleshoot it first! A lot of problems can be resolved faster than a backup, reformat, reinstall if you put a little thought into troubleshooting.
Ever Evolving
(18 items)
CPU
Phenom II 1090T Black Edition
Motherboard
Gigabyte GA-890FXA-UD5
GPU
Diamond R9 280X
GPU
XFX R9 280X
RAM
Crucial Ballistix Sport 16GB VLP DDR3 1600 CL9 1.35v
Hard Drive
Vertex 3 120GB SSD
Hard Drive
2x WD 1TB Caviar Black SATA3
Hard Drive
WD Caviar Black 640GB SATA2
Optical Drive
HP DVD-RW 1170i
Power Supply
Corsair HX1000W
Cooling
Prolimatech Megahalem
Cooling
2x Delta AFB1212SHE
Cooling
7x Cooler Master SickleFlow R4 fans
Case
Cooler Master HAF932 (Fan Mod)
Operating System
Windows 10 Professional
Monitor
2x Samsung SyncMaster E2420 23.6" 1920x1080
Keyboard
Logitech G15
Mouse
Logitech MX310
▲ hide details ▲
NameUnknown is offline  
post #9 of 17 (permalink) Old 05-02-2013, 07:44 AM - Thread Starter
New to Overclock.net
 
deezdrama's Avatar
 
Join Date: Jan 2010
Location: il
Posts: 421
Rep: 2
Going to try some of the suggestions.

Ive also noticed my firefox homepage was switched to yahoo, I reset it to default but when I search something it still shows up with yahoo results.

After exiting firefox and reopening... it now wont search or bring up any results.

What the bleep.

Could this crap really of came from a java update???

Or was I tricked into installing a bundled malware java update?
deezdrama is offline  
post #10 of 17 (permalink) Old 05-02-2013, 08:10 AM
It's a me
 
Jayjr1105's Avatar
 
Join Date: Sep 2010
Location: Central Pennsylvania
Posts: 2,868
Rep: 134
Quote:
Originally Posted by deezdrama View Post

Going to try some of the suggestions.

Ive also noticed my firefox homepage was switched to yahoo, I reset it to default but when I search something it still shows up with yahoo results.

After exiting firefox and reopening... it now wont search or bring up any results.

What the bleep.

Could this crap really of came from a java update???

Or was I tricked into installing a bundled malware java update?

From now on get programs and updates from ninite.com You'll thank me later wink.gif

Official Delidded Crewman
The Ivy STABLE Club
Nvida GTX960 Owners Club
Raspberry Pi Owners Club
I <3 Mechanical KeyboardCPU Journey (Click to show)
Celeron 333MHz > Pentium 4 2.4GHz > Athlon XP 2800+ > Athlon 64 3400+ > Athlon II X2 250 > Athlon II X4 640 > Phenom II X4 840 > i5 2500K > i7 3770K
Jayjr1105 is offline  
Reply

Quick Reply
Message:
Options

Register Now

In order to be able to post messages on the Overclock.net - An Overclocking Community forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.
User Name:
If you do not want to register, fill this field only and the name will be used as user name for your post.
Password
Please enter a password for your user account. Note that passwords are case-sensitive.
Password:
Confirm Password:
Email Address
Please enter a valid email address for yourself.
Email Address:

Log-in



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page


Forum Jump: 

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off