MBAM and navipromo (feedback)

[Thanos]

Hi

It's about MBAM dealing with navipromo infection. The infection is nuked as shown in the report >>

C:\Documents and Settings\BambiPanda\Local Settings\Application Data\lkigfd_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\BambiPanda\Local Settings\Application Data\lkigfd_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\BambiPanda\Local Settings\Application Data\lkigfd.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\BambiPanda\Local Settings\Application Data\lkigfd.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.

Just to point out that there's a leftover that MBAM didn't get (from a RSIT log) >>

Favorit-->"c:\documents and settings\bambipanda\local settings\application data\lkigfd.exe" -uninstall

a regfix must be done to delete the key ([HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Favorit]) since it cannot be uninstalled normally.

My apologies if I posted in the wrong section

[nosirrah]

I can take a look at expanding the heuristics on this one .

[Mark]

Hi guys

If I remember correctly, "Favorit" is still present in "Add/Remove" even after cleanup with Navilog as well. It's just an orphan. When you try to uninstall, it says it doesn't exist and then you simply remove the entry from the list.

HTH

Mark

[Thanos]

hi,

You're right Mark! it's just an orphan entry. Just to avoid the user be worried about a program he hasn't installed

thanks for your answer nosirrah

[Thanos]

Hi

the following infections have been found on a user's pc >>

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cont_globaladsolution (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\components\nsglobaladsolution.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\cont_globaladsolution-remove.exe (Trojan.Agent) -> Quarantined and deleted successfully.

a rsit extra log shows this after MBAM's scan, which is linked to the infection>>

Contextual Application Bignetdaddy-->C:\WINDOWS\system32\3f7b840d-083a-c445-e34f-2817c7e8aaa2.exe

Contextual Platform Globaladsolution-->C:\WINDOWS\system32\bd396ed7-998a-acf5-74fd-cb516836facd.exe

I have a sample of this file if you need it >> 3f7b840d-083a-c445-e34f-2817c7e8aaa2.exe

result of a VT scan on it >> http://www.virustotal.com/fr/analisis/dcd8...6f32-1255300087

[Thanos]

Hi,

I've forgotten to attach the file! done now!

3f7b840d_083a_c445_e34f_2817c7e8aaa2.zip