Jump to content

Random popups and trojans


Recommended Posts

Hi All,

I was hoping you could help me with whatever is wrong with my computer. I recently started experiencing pop-ups that have asked me to install stopzilla (I didn't, but I'm not sure x'ing out of it matters). I ran a-squared, Malwarebytes, and spybot. It got some stuff it seems like, but most recently Malwarebytes runs, finds 2 things, asks to restart, but when it restarts I get an error and can't seem to get rid of the last two trojans. I have the following logs available: mbam, DDS, Attach, and ark.

Malwarebytes' Anti-Malware 1.44

Database version: 3805

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2/28/2010 8:53:01 AM

mbam-log-2010-02-28 (08-53-01).txt

Scan type: Full Scan (C:\|H:\|)

Objects scanned: 237804

Time elapsed: 57 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\minibozeyi (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_09-12-01.01) - NTFSx86

Run by Chao at 9:04:52.70 on Sun 02/28/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1497 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\a-squared Free\a2service.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Malwarebytes' Anti-Malware\UBbU1TThw.exe

C:\Documents and Settings\Chao\Desktop\dds.scr

C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: {6d0b2967-c527-48c5-93e6-c5622f18ed41} - hufowebi.dll

uRun: [Google Update] "c:\documents and settings\chao\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

mRun: [DXDllRegExe] dxdllreg.exe

mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nemuravam] Rundll32.exe "c:\windows\system32\zepulabe.dll",a

mRun: [minibozeyi] Rundll32.exe "yoduvofa.dll",s

dRunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hp digital imaging monitor.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

mPolicies-system: EnableLUA = 0 (0x0)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

AppInit_DLLs: c:\windows\system32\ c:\windows\system32\zibuzuhu.dll c:\windows\system32\zepulabe.dll,sajuyaya.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

SSODL: kuvazumog - {d827dd22-05b8-4f43-a57d-b25fcbd53188} - c:\windows\system32\zibuzuhu.dll

SSODL: tosubejor - {680f411f-62c0-4955-859b-3ca694431cbe} - c:\windows\system32\zepulabe.dll

STS: kupuhivus: {d827dd22-05b8-4f43-a57d-b25fcbd53188} - c:\windows\system32\zibuzuhu.dll

STS: jugezatag: {680f411f-62c0-4955-859b-3ca694431cbe} - c:\windows\system32\zepulabe.dll

LSA: Notification Packages = scecli mlode32.dll sajuyaya.dll

IFEO: MpCmdRun.exe - c:\windows\system32\svchost.exe

IFEO: MSASCui.exe - c:\windows\system32\svchost.exe

IFEO: MsMpEng.exe - c:\windows\system32\svchost.exe

IFEO: msseces.exe - c:\windows\system32\svchost.exe

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chao\applic~1\mozilla\firefox\profiles\hklj41w4.default\

FF - prefs.js: browser.startup.homepage - hxxps://webmail.tufts.edu/|https://www.google.com/accounts/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fmail%2F%3Fui%3Dhtml%26zy%3Dl&ltmpl=default&ltmplcache=2|http://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1188609840&rver=4.5.2130.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&id=64855|http://goat.law.upenn.edu/

FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\chao\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\chao\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\chao\local settings\application data\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPMXENG.DLL

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-12 333192]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-10-12 28424]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-12 360584]

R2 a2free;a-squared Free Service;c:\program files\a-squared free\a2service.exe [2010-1-19 1858144]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-11-24 906520]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-11-24 285392]

R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-15 34064]

S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]

S0 mzpgiy;mzpgiy; [x]

S2 duppxahze;duppxahze;\??\c:\windows\system32\drivers\wonvpk.sys --> c:\windows\system32\drivers\wonvpk.sys [?]

S3 rt2870;Belkin 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2008-10-29 644096]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

=============== Created Last 30 ================

2010-02-28 14:01:17 148 -c--a-w- c:\documents and settings\chao\defogger_reenable

2010-02-28 04:39:02 696832 -c--a-w- c:\windows\isRS-000.tmp

2010-02-28 04:38:59 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-28 04:38:57 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys

2010-02-28 02:05:36 95 -c--a-w- c:\windows\wininit.ini

2010-02-27 22:31:47 0 dc----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-27 22:17:38 0 dc----w- c:\program files\Dr. Guard

2010-02-10 02:19:35 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll

2010-02-10 02:19:24 17920 -c----w- c:\windows\system32\dllcache\msyuv.dll

2010-02-10 02:19:14 48128 -c----w- c:\windows\system32\dllcache\iyuv_32.dll

2010-02-10 02:19:14 11264 -c----w- c:\windows\system32\dllcache\msrle32.dll

2010-02-10 02:19:11 343040 -c----w- c:\windows\system32\dllcache\mspaint.exe

2010-02-07 19:42:49 0 dc----w- c:\program files\Overland

2010-02-06 17:32:01 90112 -c--a-r- c:\windows\system32\hpovst08.dll

2010-02-06 17:32:01 565248 -c--a-r- c:\windows\system32\hpotscl.dll

2010-02-06 16:56:58 38867 -c----w- c:\windows\hpomdl03.dat

2010-02-06 16:56:58 29258 -c--a-w- c:\windows\hpoins03.dat

2010-02-06 15:45:29 0 dc----w- c:\windows\system32\NtmsData

2010-02-05 23:20:35 626960 -c--a-r- c:\windows\system32\hpvaut32.dll

2010-02-05 23:20:35 487424 -c--a-r- c:\windows\system32\hpvcp70.dll

2010-02-05 23:20:35 44544 -c--a-r- c:\windows\system32\MSXML4a.dll

2010-02-05 23:20:35 344064 -c--a-r- c:\windows\system32\hpvcr70.dll

2010-02-05 23:17:08 0 dc----w- c:\program files\common files\HP

2010-02-05 23:16:41 35840 -c--a-w- c:\windows\system32\drivers\AFS2K.SYS

2010-02-05 23:11:38 38867 -c----w- c:\windows\hpomdl03.dat.temp

2010-02-05 23:11:38 29188 -c----w- c:\windows\hpoins03.dat.temp

2010-02-05 17:14:59 0 dc----w- c:\program files\common files\Hewlett-Packard

2010-02-05 17:12:59 15104 -c--a-w- c:\windows\system32\drivers\usbscan.sys

2010-02-05 17:12:59 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2010-02-05 17:12:31 0 dc----w- c:\program files\HP

2010-02-05 17:11:04 21744 -c--a-w- c:\windows\system32\drivers\HPZius12.sys

2010-02-05 17:11:04 16496 -c--a-w- c:\windows\system32\drivers\HPZipr12.sys

2010-02-05 17:11:03 51088 -c--a-w- c:\windows\system32\drivers\hpzid412.sys

2010-02-05 17:11:00 274432 -c--a-r- c:\windows\system32\hpgwiamd.dll

2010-02-05 17:11:00 270336 -c--a-w- c:\windows\system32\HPZc3212.dll

==================== Find3M ====================

2010-02-28 14:02:35 0 -c--a-w- c:\windows\system32\drivers\lvuvc.hs

2010-02-28 14:02:32 0 -c--a-w- c:\windows\system32\drivers\logiflt.iad

2009-12-31 16:50:03 353792 -c--a-w- c:\windows\system32\drivers\srv.sys

2009-12-21 19:14:05 916480 -c--a-w- c:\windows\system32\wininet.dll

2009-12-16 18:43:27 343040 -c--a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08:23 33280 -c--a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:26:15 2145280 -c--a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43:51 2023936 -c--a-w- c:\windows\system32\ntkrnlpa.exe

1601-01-01 00:03:28 65024 -csha-w- c:\windows\system32\gojidisi.dll

1601-01-01 00:03:52 65024 -csha-w- c:\windows\system32\hufowebi.dll

1601-01-01 00:03:28 40960 -csha-w- c:\windows\system32\kifupiza.dll

1601-01-01 00:03:52 65024 -csha-w- c:\windows\system32\yoduvofa.dll

1601-01-01 00:03:28 95232 -csha-w- c:\windows\system32\zepulabe.dll

2009-04-29 07:18:13 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009042920090430\index.dat

============= FINISH: 9:05:27.78 ===============

I'd appreciate any help with this, thanks!

ark.zip

Attach.zip

Link to post
Share on other sites

Hello , and welcome to Malwarebytes forum!

P2P WARNING

-------------------

Going over your logs I noticed that you have BitComet installed.

[*] Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.

[*]They are a security risk which can make your computer susceptible to a sm

Link to post
Share on other sites

Hello again, that took quite care of some stuff :)

CF-SCRIPT

-------------

Open notepad and copy/paste the text in the quotebox below into it:

<http://forums.malwarebytes.org/index.php?showtopic=41813&view=findpost&p=207405>

Collect::
c:\windows\system32\gojidisi.dll
c:\windows\system32\hufowebi.dll
c:\combofix\iexplore.exe
c:\windows\system32\drivers\wonvpk.sys

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6d0b2967-c527-48c5-93e6-c5622f18ed41}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetSoft]

Driver::
duppxahze

Save this as CFScript.txt

CFScriptB-4.gif

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

  • Ensure you are connected to the internet and click OK on the message box.

Link to post
Share on other sites

Hello ,

How are things running now? Do you have any problems left?

UPDATE JAVA

------------------

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 18.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.

-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.

-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.

-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

MALWAREBYTES ANTIMALWARE

-------------------------------------------

Please launch MBAM and update the program before performing a scan.

  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

In your next reply, please include the following:

  • MBAM log

Link to post
Share on other sites

Hi again :)

No worries, all ten files are either in Combofix quarantine or in System Restore, which means they are just leftovers and not active anymore.

INSTALL FIREWALL

--------------------------

Install and use a firewall with outbound protection

While the firewall built into Windows XP is adequate to protect you from incoming attacks, it will not be much help in alerting you to programs already on your PC attempting to connect to remote servers

I therefore strongly recommend that you install one of the following free firewalls: Outpost Firewall Free, Sygate Personal Firewall Free or Zonealarm

See Bleepingcomputer's excellent tutorial to help using and understanding a firewall here

Note - If you connect to the internet using a router, you are already behind a hardware firewall.

Note: You should only have one firewall installed at a time. Having more than one firewall program installed at once is likely to cause conflicts and may well decrease your overall protection as well as seriously impairing the performance of your PC.

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      Note - when ESET doesn't find any threats, no report will be created.
    11. Push the esetBack.png button.
    12. Push esetFinish.png

Link to post
Share on other sites

Hi elise,

I currently use AVG free, is that good enough, or should I download one of the other firewalls you mentioned as well? Also, I ran ESET and it found some things. I've attached the relevant file.

One more thing -- in running MBAM and trying to get it to work, I've had to rename the file, should I copy and past the exe file back with mbam.exe now or should I just keep using it with the new (random) name?

esetscan.txt

Link to post
Share on other sites

Hello,

AFAIK AVG free does not include a firewall, only an antivirus program. However, depending on your internet connection, you might not even need a firewall (if you are behind a router, this acts as a hardware firewall).

You can try to put back the normal mbam executable. Please let me know if this gives you any trouble.

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :)

Please do the following to remove the remaining programs from your PC:

  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    • Delete DDS and GMER (this is a random named file)

Please read these advices, in order to prevent reinfecting your PC:

  1. Install and update the following programs regularly:
    • an outbound firewall
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    • MVPs hosts file
      A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing ;).

Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.