Infected by a Trojan Vundo & FakeAlert / Netsky?

[Aluminus]

Hi,

McAfee has picked up a Trojan NetSky & Fakealert-K. McAfee doesn't seem to have fixed them though.

I ran Malwalwarebytes and got 6 items(see below). I am getting a pop up message & warning about (TrojanSPM/LX) which is likely the a false Security Internet 2010 add/site/

I am not sure to allow MalwareBytes to remove the 6 items.

Should I do something else first or allow Malwarebytes to remove these items?

Running windows xp and tirned off system restore.

Malwarebytes' Anti-Malware 1.44

Database version: 3631

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

01/25/10 12:20:36 PM

mbam-log-2010-01-25 (12-20-27).txt

Scan type: Quick Scan

Objects scanned: 6660

Time elapsed: 16 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

C:\WINDOWS\system32\smss32.exe (Trojan.Downloader) -> No action taken.

Memory Modules Infected:

C:\WINDOWS\MSCTDR1.dll (Trojan.Hiloti) -> No action taken.

Registry Keys Infected:[

No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.Downloader) -> No action taken.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: msctdr1.dll -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\MSCTDR1.dll (Trojan.Vundo.H) -> No action taken.

C:\WINDOWS\system32\smss32.exe (Trojan.Downloader) -> No action taken.

Thanx

Aluminus

[miekiemoes]

Hi,

First of all, please enable System restore again. Maybe some people recommend this to disable it, but imho, that's a bad idea. Reason is, for example, you're trying to clean malware and you've deleted the wrong file or wrong key by accident, or a scanner deleted the wrong file/key (which may happen as well) and because of that, your system becomes more unstable. So, in such cases, you can revert to a previous system restore point.

But if you disable system restore during cleanup, you won't have any previous system restore points anymore, because your system restore points are flushed when you disable system restore. So, if something bad happens during cleanup, you cannot revert to a previous system restore point either.

So, it's better to have an "infected" system restore point (which we can clean), than no system restore point at all.

Afterwards, once your system is clean again, then you can flush your system restore points, by disabling system restore, reboot, enable system restore, so it will create a new clean system restore point afterwards again.

What malwarebytes found is malware and needs to get deleted, so please let Malwarebytes delete what it found and reboot afterwards.

Then, after reboot, please update MalwareBytes, because the databaseversion is outdated.

• Start MalwareBytes and click the Update tab. There click "Check for updates"
  
• Once the updates are downloaded, perform a quick scan again.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply along with a fresh HijackThis log, then we'll proceed from there with new steps.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[miekiemoes]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!