Victek Posted March 6, 2010 ID:210519 Share Posted March 6, 2010 I recently worked on an XP system where AVG kept detecting:trojan horse backdoor generic11.awszThe file name and location:c:\documents and settings\all users\start menu\programs\startup\uninstall.exeAlthough MBAM was able to remove a number of infections this file remained. I also scanned with Hitman Pro, Remove Fake Antivirus 1.62, ClamAV/Immunet and Panda Cloud AV. These programs either couldn't remove the infection or couldn't even detect it. Any thoughts about how to deal with this? Thanks! Link to post Share on other sites More sharing options...
Staff screen317 Posted March 7, 2010 Staff ID:211112 Share Posted March 7, 2010 Hi and welcome to Malwarebytes.Are you still working on this computer??If so, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.After you do that, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Victek Posted March 8, 2010 Author ID:211137 Share Posted March 8, 2010 Hi and welcome to Malwarebytes.Are you still working on this computer??If so, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.After you do that, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317.Unfortunately I don't have immediate access to the machine. I will check with the customer and if possible will pursue it. Thanks for the reply though, and the instructions which no doubt will be necessary again at some point. Link to post Share on other sites More sharing options...
Staff screen317 Posted March 11, 2010 Staff ID:212800 Share Posted March 11, 2010 Okay, thanks for letting me know.If you are running MBAM on "customers" then you need to contact corporate support about getting a technician's license. Otherwise I believe it is a violation of the EULA.Please contact them here:http://www.malwarebytes.org/corporate.php Link to post Share on other sites More sharing options...
Victek Posted March 11, 2010 Author ID:212811 Share Posted March 11, 2010 Okay, thanks for letting me know.If you are running MBAM on "customers" then you need to contact corporate support about getting a technician's license. Otherwise I believe it is a violation of the EULA.Please contact them here:http://www.malwarebytes.org/corporate.php.Thanks for making me aware of that. I'll check it out. Link to post Share on other sites More sharing options...
Staff screen317 Posted March 18, 2010 Staff ID:216507 Share Posted March 18, 2010 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts