Jump to content

Repeat scans show no problems after cleaning. Really?


Recommended Posts

I'm new to Malwarebytes and ran a scan today after having a few days of internet connectivity issues. This is what I got:

Malwarebytes' Anti-Malware 1.41

Database version: 2775

Windows 5.1.2600 Service Pack 3

10/8/2009 3:17:23 PM

mbam-log-2009-10-08 (15-17-23).txt

Scan type: Quick Scan

Objects scanned: 87639

Time elapsed: 4 minute(s), 59 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 12

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\WINDOWS\system32\twain_32 (Backdoor.Bot) -> Quarantined and deleted successfully.

Files Infected:

C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

After cleaning and multiple scans, I see nothing else. How solid is this software and should I be scanning with something else?

Link to post
Share on other sites

Hi kerist, and Welcome to Malwarebytes.org

The first thing to know is that MBAM is not meant to replace another anti-virus product, but to be an adjunct. MBAM targets only the hard to deal with malware that a typical AV doesn't handle at all or at least not very well. It ignores most of the malware that the other AV companies already know how to handle. Granted, there is some overlap, but you should still run an updated AV program at all times in addition to MBAM.

A lot of our forum members are pretty passionate about their choice of AV program, and some of them even have an order of preference for one or another. Pretty much you can't go wrong with Kaspersky, ESET NOD32, Avira, or Avast. They are all good. Avira and Avast have free versions as well as paid versions. Kaspersky and ESET have trial versions available.

Link to post
Share on other sites

I had been running a free scan that didnt pick it up. I made a stupid mistake and am paying for it. Hopefully with nothing other than my pride.

I run a firewall but am concerned it is useless with these backdoor.bot programs. Did the active Firewall protect me at all or am I screwed? Thanks for your help!

Hi kerist, and Welcome to Malwarebytes.org

The first thing to know is that MBAM is not meant to replace another anti-virus product, but to be an adjunct. MBAM targets only the hard to deal with malware that a typical AV doesn't handle at all or at least not very well. It ignores most of the malware that the other AV companies already know how to handle. Granted, there is some overlap, but you should still run an updated AV program at all times in addition to MBAM.

A lot of our forum members are pretty passionate about their choice of AV program, and some of them even have an order of preference for one or another. Pretty much you can't go wrong with Kaspersky, ESET NOD32, Avira, or Avast. They are all good. Avira and Avast have free versions as well as paid versions. Kaspersky and ESET have trial versions available.

Link to post
Share on other sites

If you do anything sensitive online, and many of us do, you should change your passwords at the least. This would include things like online banking, credit card purchases, etc. I just don't have a lot of confidence with firewalls when it comes to some of this modern malware. Often times, they get disabled by the malware and then you may as well not have it in the first place. You should still run another scan with a full AV program and make sure it doesn't find anything either. If you like, you can get some better peace of mind by having one of the experts in the Malware Removal HijackThis Logs forum take a look and make sure you are clean.

EDIT: To clarify - When you change your passwords, it should be from a KNOWN CLEAN system, not an infected/cleaned one.

Please read and follow ALL the instructions below. Thanks!

Scan and post logs - read note at bottom in green

If you're having Malware related issues with your computer that you're unable to resolve.

  1. Please read and follow the instructions provided here: I'm infected - What do I do now?
  2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
  3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.

  • Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  • Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  • Using these other tools often makes the cleanup task more difficult and time consuming.
  • If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  • Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  • There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review

  • NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.