Fake system scan

[Eric72]

Hi,

When I start my laptop, I get a fake virus-scan thing pop-up, and almost everything is missing from my desktop and start bar (everything is still on my laptop though, I just can't see it).

Any help would be hugely appreciated, thanks!

Attach.txt

DDS.txt

[MrCharlie]

Welcome to the forum.

See if following this guide works.

Make sure you run rkill and/or exeHelper and then immediately run MBAM as desribed.

Most important....update MBAM before you run it.

The link below explains how to rename MBAM if needed:

http://forums.malwarebytes.org/index.php?showtopic=55485&view=findpost&p=274963

Post the logs back here, Good Luck....MrC

[Eric72]

Thanks for the quick response!

Attached logs for rkill and MBAM. When I first got the fake pop-up, I ran rkill, then MBAM, and MBAM did detect the 2 items and deleted them, but when the laptop restarted, they were still there and I was/am still having the same problem.

mbam-log-2011-12-09 (12-33-52).txt

rkill.log

[MrCharlie]

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

[Eric72]

Okay, here you are:

Extras.Txt

OTL.Txt

[MrCharlie]

Please do this:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following

  
  :OTL
  O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
  O4 - HKU\S-1-5-21-2844847763-3726028296-3422661878-1000..\Run: [FNFPDoJienHIJQ.exe] C:\ProgramData\FNFPDoJienHIJQ.exe ()
  [2011/12/09 10:22:19 | 000,000,000 | ---D | C] -- C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix
  [2011/12/09 10:53:46 | 000,000,320 | ---- | M] () -- C:\ProgramData\~xCqSA691PCS5A4
  [2011/12/09 10:53:46 | 000,000,232 | ---- | M] () -- C:\ProgramData\~xCqSA691PCS5A4r
  [2011/12/09 10:53:16 | 000,000,456 | ---- | M] () -- C:\ProgramData\xCqSA691PCS5A4
  [2011/12/09 10:51:31 | 000,000,629 | ---- | M] () -- C:\Users\Eric\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
  [2011/12/09 10:22:19 | 000,000,605 | ---- | M] () -- C:\Users\Eric\Desktop\System Fix.lnk
  [2011/12/09 10:22:12 | 000,349,320 | ---- | M] () -- C:\ProgramData\xCqSA691PCS5A4.exe
  [2011/12/09 10:19:48 | 000,440,968 | ---- | M] () -- C:\ProgramData\FNFPDoJienHIJQ.exe
  [2011/12/09 10:51:31 | 000,000,629 | ---- | C] () -- C:\Users\Eric\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
  [2011/12/09 10:22:19 | 000,000,320 | ---- | C] () -- C:\ProgramData\~xCqSA691PCS5A4
  [2011/12/09 10:22:19 | 000,000,232 | ---- | C] () -- C:\ProgramData\~xCqSA691PCS5A4r
  [2011/12/09 10:22:16 | 000,000,456 | ---- | C] () -- C:\ProgramData\xCqSA691PCS5A4
  [2011/05/21 13:29:20 | 000,001,482 | -HS- | C] () -- C:\Users\Eric\AppData\Local\e4p658450oy660al14dx
  [2011/05/21 13:29:20 | 000,001,482 | -HS- | C] () -- C:\ProgramData\e4p658450oy660al14dx
  [2011/05/19 09:21:46 | 000,007,998 | -HS- | C] () -- C:\Users\Eric\AppData\Local\405a481v1p73r00sd4854fqwg0637xef60j3i2n5xlhy
  [2011/05/19 09:21:46 | 000,007,998 | -HS- | C] () -- C:\ProgramData\405a481v1p73r00sd4854fqwg0637xef60j3i2n5xlhy
  [2011/05/16 19:37:34 | 000,002,720 | -HS- | C] () -- C:\Users\Eric\AppData\Local\87f84b07txx0r24302jh1v
  [2011/05/16 19:37:34 | 000,002,720 | -HS- | C] () -- C:\ProgramData\87f84b07txx0r24302jh1v
  [2011/05/08 17:07:01 | 000,005,246 | -HS- | C] () -- C:\Users\Eric\AppData\Local\r74o1p54t2
  [2011/05/08 17:07:01 | 000,005,246 | -HS- | C] () -- C:\ProgramData\r74o1p54t2
  [2011/04/30 15:04:21 | 000,007,840 | -HS- | C] () -- C:\Users\Eric\AppData\Local\47h7308i05434q7ml6uhge302
  [2011/04/30 15:04:21 | 000,007,840 | -HS- | C] () -- C:\ProgramData\47h7308i05434q7ml6uhge302
  [2011/04/08 08:36:53 | 000,003,036 | -HS- | C] () -- C:\Users\Eric\AppData\Local\bkels6fq4t8a1c772
  [2011/04/08 08:36:53 | 000,003,036 | -HS- | C] () -- C:\ProgramData\bkels6fq4t8a1c772
  [2011/04/04 22:14:45 | 000,010,120 | -HS- | C] () -- C:\Users\Eric\AppData\Local\0810l5u6odc6bt4h
  [2011/04/04 22:14:45 | 000,010,120 | -HS- | C] () -- C:\ProgramData\0810l5u6odc6bt4h
  
  

  
  

• Then click the Run Fix button at the top
  
• Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  
• Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
  

------------------------------------

Then........

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Make sure you run ComboFix from your desktop.

Please include the C:\ComboFix.txt in your next reply for further review.

MrC

[Eric72]

Alright:

12092011_140906.log

combofixlog.txt

[MrCharlie]

Looking better.

Please Update and run a Quick Scan with MBAM, post the report and let me know how it is, MrC

[Eric72]

Now when I start my laptop it's normal, don't get any error messages or fake virus scans! Looks like it worked, so far so good!

mbam-log-2011-12-09 (14-47-52).txt

[MrCharlie]

That's Good News!

Your Java is out of date: Java 6 Update 26 <---should be 29

Look in your control panel for Java > click on update tab > update

------------------------------------

Please uninstall ComboFix:

Click on the Start button and then in the Search field enter combofix /uninstall

Please note that there is a space between combofix and /uninstall.

Once you have typed this in, press Enter on your keyboard. A Open File security warning will appear asking if you are sure you want to run ComboFix. Please click on the Run button to start the program.

ComboFix will now uninstall itself from your computer and remove any backups and quarantined files. When it has finished you will be greeted by a dialog box stating that ComboFix has been uninstalled. You can now delete the ComboFix.exe program from your computer. ComboFix has now been uninstalled from your Windows Vista or Windows 7 computer.

-----------------------------------

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

-----------------------------------

Any questions...please post back.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, Have a Good Holiday and New Year, MrC

[Eric72]

Updated Java, but even though I followed the steps and saved it to desktop, I can't find combofix /uninstall regardless of searching from the start bar or using 'search everywhere'.

[MrCharlie]

There's instruction near the bottom of the CF page:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I don't have Vista so I can't try it

Running OTL CleanUp will do the same thing.

MrC

[Eric72]

Ran OTL clean-up, no problem. Can't find any way to uninstall Combofix, no matter how I search or type it, but everything apart from that is completely back to normal.

Thanks so much for your time and help!

[MrCharlie]

Running OTL will uninstall ComboFix, so you're fine.

Take Care....MrC

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!