Deleting CRAWLER from my computer

Kimberley

aliEnRIK wrote: »

What link are you talking about?

Far as I can tell LSP did its job so please continue with combofix

The CFS script that was supposed to drag into combofix

aliEnRIK

Open malwarebytes
Goto MORE TOOLS
then RUN TOOL

use the tool to manually remove the file ~
c:\users\Kimberley\AppData\Roaming\wklnhst.dat

Kimberley

aliEnRIK wrote: »

Open malwarebytes
Goto MORE TOOLS
then RUN TOOL

use the tool to manually remove the file ~
c:\users\Kimberley\AppData\Roaming\wklnhst.dat

Ok that was deleted. Thanks AliENRIK, I really appreciate your help. Is that it now am I safe to use my online bank account?

Richie-from-the-Boro

RIK

# 25 Rik says : - This one fascinates me ~ Whats that all about? Its legit ~ but id definitely questioning if its any good? And what exactly does it do?

It's Net Nanny, owned by ContentWatch, but it's not showing in any of the O/P's logs M8 so it may be a corrupted uninstall or whatever.

Behavior:

The Process is packed and/or encrypted using a software packing process
Executes a Process
Can communicate with other computer systems using HTTP protocols
Registers a Dynamic Link Library File
This Process sends MIME Email
Adds products to the system registry
Created as a new Background Service on the machine
Created as a process on disk
Executed as a Process
Has code inserted into its Virtual Memory space by other programs
Deleted as a process from disk

Aliases

CWSVC.EXE.TMP89771015.TXT82036419.SVD44413737.SVD76212541.TXT93508022.TXT33602507.TXT20292947.TXT

Vendor & Product Info

ContentWatch, Inc.; cwsvc.exe; 2.5.0.180
ContentWatch; UTN-USERFirst-Object;
ContentWatch, Inc.; cwsvc.exe; 2.6.0.178
ContentWatch, Inc.; cwsvc.exe; 2.6.3.6
ContentWatch Inc; UTN-USERFirst-Object;
ContentWatch, Inc.; UTN-USERFirst-Object;
ContentWatch, Inc.; cwsvc.exe; 2.7.4.2
ContentWatch, Inc.; cwsvc.exe; 2.8.2.19

N.B. - the red bits are my highlighting !

aliEnRIK

Kimberley wrote: »

Ok that was deleted. Thanks AliENRIK, I really appreciate your help. Is that it now am I safe to use my online bank account?

I can never say with absolute certainty that anyones computer is completely clean. But sure, looks fine to me

Kimberley

aliEnRIK wrote: »

I can never say with absolute certainty that anyones computer is completely clean. But sure, looks fine to me

Thank you

Oh and yes Content watch I installed when my son was being bullied online to watch what was going on. As far as I know I deleted net nanny when things inproved.

aliEnRIK

You should use hijack to remove that item then

then give it a spring clean

Download CCLEANER
http://www.piriform.com/ccleaner/download/slim
Run the CLEANER scan (UNTICK 'cookies')
Then run the REGISTRY scan (Backup the registry when it asks)

Kimberley

Thank you so much :beer: