Cherie Posted November 18, 2009 ID:159606 Share Posted November 18, 2009 One of our employees computers received a virus notification about a Downloader that was reportedly "cleaned by deletion" by the Symantec AV product we use. I cleared out all cache and temporary files then re-ran a scan to confirm it was clean.For good measure I also ran a Malwarebytes scan. It did find some "Rogue.Mulitple" items but took no action. Please see attached MBAM log file.I haven't been able to find anything on the Rogue.Multiple entries in the log file. Can you please review and let me know if this is something new I should do something about or if it's a false positive?The machine is not exhibiting any odd behavior, which is why I did not include HJT logs. I only need to know if this "Rogue.Mulitple" is a false positive or not. If you still require HJT logs, please let me know.Thanks...cbcmbam_log_2009_11_18__13_25_16_.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted November 19, 2009 Staff ID:159849 Share Posted November 19, 2009 Hi,This is nothing new though, but known leftovers from a Rogue antispywarescanner, so let Malwarebytes delete what it found.Yes, also post a HijackThislog in your next reply. Link to post Share on other sites More sharing options...
Cherie Posted November 19, 2009 Author ID:159934 Share Posted November 19, 2009 Please see attached HJT log.hijackthis.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted November 19, 2009 Staff ID:159938 Share Posted November 19, 2009 Hi,There's a leftover from Adware.Deepdive here:O18 - Filter hijack: text/html - {9fc93e77-e01a-4ece-b323-b954a21849c2} - C:\WINDOWS\mark_32.dllCan you check if the file still exists? C:\WINDOWS\mark_32.dllThis because malwarebytes should detect and delete this file. Link to post Share on other sites More sharing options...
Cherie Posted November 19, 2009 Author ID:160023 Share Posted November 19, 2009 Confirmed the file C:\WINDOWS\mark_32.dll wasn't there. So this should be OK then, we're clean? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted November 19, 2009 Staff ID:160028 Share Posted November 19, 2009 Good.Just check next entry in HijackThis and click the fix checked button:O18 - Filter hijack: text/html - {9fc93e77-e01a-4ece-b323-b954a21849c2} - C:\WINDOWS\mark_32.dllIn case it won't go away in HijackThis (as this appears to be a common problem with Protocol registry entries in HijackThis), do the following...Open notepad and copy and paste next present in the quotebox below in it:(don't forget to copy and paste REGEDIT4)REGEDIT4[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html]Save this as fix.reg Choose to save as *all files and place it on your desktop.It should look like this: Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok. Link to post Share on other sites More sharing options...
Cherie Posted November 19, 2009 Author ID:160031 Share Posted November 19, 2009 If HijackThis found something, but that file doesn't exist on my machine, what exactly is that registry change supposed to do? I'd like to understand it better before I do it, especially if it has the potential of breaking something else. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted November 19, 2009 Staff ID:160040 Share Posted November 19, 2009 Hi,It's a protocol class registered by this malicious file, so the registryfix removes that protocol again in the registry as this is not a default protocol set in Windows anyway.You can't break anything with it since the related file is gone - so it's just an orphaned protocol\filter entry in the registry. Link to post Share on other sites More sharing options...
Cherie Posted November 19, 2009 Author ID:160052 Share Posted November 19, 2009 Mieke, you have been very helpful. Thank you! Link to post Share on other sites More sharing options...
Staff miekiemoes Posted November 19, 2009 Staff ID:160053 Share Posted November 19, 2009 Glad I could help Link to post Share on other sites More sharing options...
Staff miekiemoes Posted November 22, 2009 Staff ID:161159 Share Posted November 22, 2009 Since this issue appears resolved ... this Topic is closed.If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.Everyone else please begin a New Topic. Link to post Share on other sites More sharing options...
Recommended Posts