winupdate86.exe (Trojan.FakeAlert)

[Lipson]

I'm using XP Pro, AVG, Malwarebytes paid version, Zone Alarm and I got the Winupdate86 spyware with the fake background, "Your computer is infected". It was a drive by download off of a site using firefox 3.5.5 and Malwarebytes did not stop it, but warned me. I ran mscong to turn off Winupdate86 and then Smitfraudfix to stop it and then ran malwarebytes to clean up the remainder. Here is part of the log: Why didn't malwarebytes fail to stop this? Thanks for your help.

Malwarebytes' Anti-Malware 1.41

Database version: 3217

Windows 5.1.2600 Service Pack 3

11/23/2009 12:42:14 PM

mbam-log-2009-11-23 (12-42-14).txt

Scan type: Quick Scan

Objects scanned: 104249

Time elapsed: 4 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\critical_warning.html (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\winupdate86.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\AVR10.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

[swagger]

Hello Lipson, and welcome to the Malwarebytes' forum!

Not sure if you are looking for removal help or an answer to why the infections on your computer were not prevented. If you are looking for the latter, you will need to wait for a staff member to answer you question. If you are looking for the former, please see below:

We do not work on malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

Regards,

Keith

[Lipson]

Hello Lipson, and welcome to the Malwarebytes' forum!

Not sure if you are looking for removal help or an answer to why the infections on your computer were not prevented. If you are looking for the latter, you will need to wait for a staff member to answer you question. If you are looking for the former, please see below:

We do not work on malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

Regards,

Keith

Keith:

Thanks for the help. I wanted to know how this thing got in with my paid version of malwarebytes running. I thought it would stop it. It's not a new malware. Is there a better program to stop these things? Thanks again for the assistance.

[mountaintree16]

@ Lipson I'd go to the HJT forum to ask for help with removal if you haven't already.

Also, may I ask what website this happened on, or are you not sure?

Also, as a side note, when replying, please use the "add reply" button at the bottom of the page or erase waht the person before you said and address them as @username or username: as this makes the forum easier to read