Help Please - Not sure if i am infected .

[H0peless]

Hi,

As will be blatantly obvious i am terrible with computers so i apologise for being annoying from the start.

I have recently been a victim of bank fraud so i am currently trying to work out how they got hold of my details. An obvious one is through a virus/trojan i know but i don't want to jump to conclusions yet even though i probably should do as i haven't been given an answer yet by the bank as to how it happened.

I know i will probably have to reinstall windows but the thought fills me with dread and i also want to try and work out how they hacked me first if i can.

Anyway here is the result of my recent log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8330

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

08/12/2011 01:31:52

mbam-log-2011-12-08 (01-31-40).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 259529

Time elapsed: 56 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\1000000600002i\svchost.exe (Rootkit.Dropper) -> No action taken.

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\1000000800002i\svchost.exe (Rootkit.Dropper) -> No action taken.

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\1000000b00002i\rundll32.exe (Rootkit.Dropper) -> No action taken.

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\4000002c0600002i\photoshop.exe (Rootkit.Dropper) -> No action taken.

I have no idea to the seriousness of these files and what they do also i am confused by their location and the fact they seem to be in deleted files. I have tried googling but i got nowhere.

There is a deleted photoshop folder in my recycle bin which i forgot about and which i am leaving for now until i know more.

Can someone tel me please how serious these are ?

Also is it possible to get trojans/viruses in this location?

Thanks for your help.

[3p1x]

For what its worth, yes; those are in your "Recycle Bin" and in a state of "deleted but recoverable". Emptying your trash can should remove them from you system.

I am not authorized to provide help, just offering knowledge from computer repair experience.

[H0peless]

Thanks for the reply. I don't suppose you know how serious they are, if at all? I just wanted to know whether they were actual viruses/trojans before i deleted them. Yeah i was googling about C:\$RECYCLE.BIN and whether trojans could "operate etc" from there but i'm too useless to find anything. I found out if you search for C:\$RECYCLE.BIN in the address search bar of your internet browser some weird stuff comes up but it means nothing to me.

[H0peless]

I should add that my friend from whom i got the Photoshop C3S portable has also run Malwarebytes and the only thing hat was found was 3 files very similar to ones found on my computer except in a different location, i think, in my documents somewhere.

Ie:

A, svchost.exe , rundll32.exe and photoshop.exe.

The files found infected on mine are:

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\1000000600002i\svchost.exe (Rootkit.Dropper) -> No action taken.

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\1000000800002i\svchost.exe (Rootkit.Dropper) -> No action taken.

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\1000000b00002i\rundll32.exe (Rootkit.Dropper) -> No action taken.

c:\$RECYCLE.BIN\s-1-5-21-4054292811-2639179496-1958547070-1000\$RTSR0FK\CSDATA\4000002c0600002i\photoshop.exe (Rootkit.Dropper) -> No action taken.

Just in case this post has been missed because of the replies i don't suppose anyone knows if these are malware or signs of malware, with the source being the Photoshop C3S portable folder or whether they are just false positives?

[screen317]

Hi,

I'm afraid I have bad news.

Your logs reveal a backdoor trojan. A backdoor severely compromises system integrity.

A compromised system may allow illicit network connections, disabling of security software, modifying critical system files and collection and transmiission of personal identifiable information without your consent.

I recommend that you disconnect this PC from the Internet immediately, and only reconnect to download any tools that are required. If you do any banking or other financial transactions on the PC or it if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. If it were on my PC I would not hesitate for a moment to do so. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

Should you decide not to follow that advice, we will of course do our best to clean the computer of any infections that we can see but, as I already stated, we can in no way guarantee it to be trustworthy.

Should you have any questions, please feel free to ask.

Let me know what you decide.

[screen317]

Are you still with us? This topic will be closed in a few days if we do not hear back from you.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!