tinkerbell Posted January 20, 2010 ID:186528 Share Posted January 20, 2010 2 days ago, I was hit with malware. I ran several anti-malware programs and quarantined "Trojan.Agent/Gen-FakeSpy [broad] (4 infected items), and worse: Rogue.Agent/gen, with 37 registry items infected. After running a scan and removing to quarantine, I tried to update my anti-malware pgms and could not do so, getting error code 732 (12029, 0) after I could not connect. None of my anti-virus or anti-spyware software will update, including Norton. In fact, Norton was useless in detecting the infections. Another effect of the malware was to leave me with a defective connection for Internet Explorer 7. I tried downloading 8 but that, too, is disabled. Here's some of the code in quarantine. For Trojan.Agent/Gen-fakespy: windows\prefetch\uldesysguard.exe-15812F87.pf. For Rogue.Agent/gen: a long list of registry keys that were infected, with AVSCAN appearing in most of them (maybe that's normal for registry keys, but I am clueless!)Is anyone else experiencing this? Is there any help short of reinstalling Windows (not an attractive option) ? Link to post Share on other sites More sharing options...
Staff screen317 Posted January 20, 2010 Staff ID:186571 Share Posted January 20, 2010 Hi and welcome to Malwarebytes.Next, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.After you post that log, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
tinkerbell Posted January 21, 2010 Author ID:186944 Share Posted January 21, 2010 2 days ago, I was hit with malware. I ran several anti-malware programs and quarantined "Trojan.Agent/Gen-FakeSpy [broad] (4 infected items), and worse: Rogue.Agent/gen, with 37 registry items infected. After running a scan and removing to quarantine, I tried to update my anti-malware pgms and could not do so, getting error code 732 (12029, 0) after I could not connect. None of my anti-virus or anti-spyware software will update, including Norton. In fact, Norton was useless in detecting the infections. Another effect of the malware was to leave me with a defective connection for Internet Explorer 7. I tried downloading 8 but that, too, is disabled. Here's some of the code in quarantine. For Trojan.Agent/Gen-fakespy: windows\prefetch\uldesysguard.exe-15812F87.pf. For Rogue.Agent/gen: a long list of registry keys that were infected, with AVSCAN appearing in most of them (maybe that's normal for registry keys, but I am clueless!)Is anyone else experiencing this? Is there any help short of reinstalling Windows (not an attractive option) ? Link to post Share on other sites More sharing options...
tinkerbell Posted January 21, 2010 Author ID:186945 Share Posted January 21, 2010 Hi and welcome to Malwarebytes.Next, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.After you post that log, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
tinkerbell Posted January 21, 2010 Author ID:186947 Share Posted January 21, 2010 I'm afraid that I ran another anti-spyware program before I actually installed Malwarebytes, and altho I have the infection info in quarantine within that program, I have been unable to export it to my desktop for use as you suggested. (big sigh)Hi and welcome to Malwarebytes.Next, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.After you post that log, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted January 21, 2010 Staff ID:187193 Share Posted January 21, 2010 Hi,Please use the ADDREPLY button to reply instead of the "REPLY button.I'm afraid that I ran another anti-spyware program before I actually installed Malwarebytes, and altho I have the infection info in quarantine within that program, I have been unable to export it to my desktop for use as you suggested. (big sigh)I'm afraid I have no idea what you are talking about. Nowhere did I mention quarantine.I instructed you to run two tools; please do so. Link to post Share on other sites More sharing options...
Staff screen317 Posted February 3, 2010 Staff ID:193741 Share Posted February 3, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts