Heur.Trojan.Win32.Generic infection (maybe?)

[bkoopers]

I am having a problem with Symantec Norton 360 v4.0 anti-virus software not running (it keeps getting disabled and will not open). At first, it only got disabled when I installed pcAnywhere v10.51 but even after uninstalling pcAnywhere and Norton 360 and then re-installing Norton 360 (without installing pcAnywhere), Norton 360 v4.0 sometimes will not start up when the computer is powered on (and cannot be manually opened) but if I restart the computer, then it works OK. When Norton 360 v4 is in the

Attach.zip

[Kenny94]

Hi bkoopers And

First of all, please update MalwareBytes, because the databaseversion appears to be outdated.

Update Run Malwarebytes

• Launch Malwarebytes' Anti-Malware
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[bkoopers]

Thank you for your response.

I ran the update and then the quick scan. No infections were found. This is the log file information:

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Database version: 3967

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/7/2010 6:43:51 PM

mbam-log-2010-04-07 (18-43-51).txt

Scan type: Quick scan

Objects scanned: 115931

Time elapsed: 6 minute(s), 59 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

The

[Kenny94]

The

[bkoopers]

I disabled Symantec Norton 360 and Malwarebytes' Anti-Malware and then executed ComboFix. It installed the Microsoft Windows Recovery Console and then ran the scan and created a log file. I have attached the log file inside of the attached ComboFixLog.zip file.

My default web browser is Apple Safari. When I tried to go to the Malwarebytes forum to send this response, Internet Explorer opened up instead of Apple Safari. I tried to start Apple Safari directly and it would not start and the icon for the shortcut was now a blank icon. I checked the

ComboFixLog.zip

[bkoopers]

Something very strange just happened. After I posted the above response, I noticed that the icon for the Apple Safari shortcut had returned. I then checked the

[Kenny94]

Do you have an explanation for this mysterious disappearance and re-appearance of the Apple Safari executable file?

ComboFix removed some infectious that was blocking it.

I'm reviewing your log and will have some more instructions for you in a short while. Thanks for your patience!

[Kenny94]

Note: You should remove uTorrent. P2P (peer-to-peer) using P2P software is very risky, because it makes you very susceptible to infection, attack, exposure of personal or company information. And most likely cause "The Rootkit". But this is up to you to remove uTorrent

Run CFScript

• Close any open browsers.
  
• Open Notepad by click start
  
• Click Run
  
• Type notepad into the box and click enter
  
• Notepad will open
  
• Copy and Paste everything from the Code box into Notepad:
  

Registry:: 
[HKEY_LOCAL_MACHINE\software\microsoft\security center] 
"AntiVirusOverride"=dword:00000000 
"FirewallOverride"=dword:00000000

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new MBAM log.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Update Run Malwarebytes

• Launch Malwarebytes' Anti-Malware
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[bkoopers]

I use uTorrent maybe once every few weeks just when I miss an episode of a current TV series. I understand the risks but I would prefer not to give up that ability. If Malwarebytes' Anti-Malware cannot prevent an infection from using uTorrent, if it can at least tell me that there is an infection, I would then be able to take steps to remove the infection.

I disabled Symantec Norton 360 and Malwarebytes' Anti-Malware. I created the CFScript.txt file and dragged it onto ComboFix.exe which started ComboFix. I have attached the log file inside of the attached ComboFixLog.zip file.

I noticed that the CFScript.txt file was gone after it was dropped onto ComboFix.exe.

I restarted the computer (because most of the System Tray icons were gone). I then noticed that the default web browser was again Internet Explorer instead of Apple Safari but this time Apple Safari still works if I open it directly.

Has the log files of any of the infection detection programs that I executed per your directions indicated any infection?

Please advise what the results were in the latest ComboFix log file and what I should do next.

Thanks once again for your assistance.

[Kenny94]

And the MBAM Log?

[bkoopers]

I

[Kenny94]

Hi

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go here then click on:
  
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  
• Now click on Advanced Settings and select the following:
  

• • Scan for potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth Technology
    

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Next

Download Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

In your next reply, please include these log(s):

EsetOnlineScanner\log.txt

checkup.txt

Also, please let me know how things are running now and if you encountered any problems while you were following the instructions I posted.

[bkoopers]

Here are two strange occurrences that I noticed after ComboFix was run (that I noticed after I posted my previous report on ComboFix):

I had the Windows Registry configured (using Microsoft

ESET_and_SecurityCheck_log_files.zip

[Kenny94]

I used to use Safari, but had to many problems with Windows. I mean Safari runs great for awhile then I had a lot of problems as you and more...bkoopers.

Unlocker is fine and it's a false positive. As for Tweak UI when you remove ComboFix it should be fine.

There are some older versions of Java on your computer. These can be a source of infection.

[

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  
• Scroll down to where it says Java SE Runtime Environment (JRE) - JRE 6 Update 20 -
  
• Click the Download button to the right.
  
• Select the Windows platform from the dropdown menu.
  
• Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6u16 with JavaFX 1 License Agreement. Click on Continue.The page will refresh.
  
• Click on the link to download Windows Offline Installation and save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u120 -windows-i586-p.exe to install the newest version.
  

• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
    
  • Next, click on the Delete Files button
    
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
      Trace and Log Files
      

    [*]Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

    [*]Click OK to leave the Temporary Files Window

    [*]Click OK to leave the Java Control Panel.

To test your Java Run-time, you may go to this page http://www.java.com/en/download/help/testvm.xml

When all is well, you should see Java Version: 1.6.0_20 from Sun Microsystems Inc.

Be sure you use Secunia software inspector & update checker

Your Computer is Clean

Some final items:

Follow these steps to uninstall Combofix and tools used in the removal of malware

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the x and /)
  
  
• Please follow the prompts to uninstall Combofix.
  
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
  

This will uninstall Combofix and anything assoicated with it.

Here are some additional links for you to check out to help you with your computer security.

Browsers

Just because your computer came loaded with Internet Explorer doesn't mean that you have to use it, there are other free alternatives, FIREFOX and OPERA, both are free to use and are more secure than IE.

If you are using firefox you can stay more secure by adding NoScript and WOT (Web Of Trust)

NoScript stops Java scripts from starting on a web page unless you give permission for them, and WOT (Web Of Trust) has a comprehensive list of ratings for different websites allowing you to easily see if a website that you are about to go to has a bad reputation; in fact it will warn you to check if you are sure that you want to continue to a bad website.

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  
• From within Internet Explorer click on the Tools menu and then click on Options.
  
• Click once on the Security tab
  
• Click once on the Internet icon so it becomes highlighted.
  
• Click once on the Custom Level button.
  
• Change the Download signed ActiveX controls to Prompt
  
• Change the Download unsigned ActiveX controls to Disable
  
• Change the Initialize and script ActiveX controls not marked as safe to Disable
  
• Change the Installation of desktop items to Prompt
  
• Change the Launching programs and files in an IFRAME to Prompt
  
• Change the Navigate sub-frames across different domains to Prompt
  
• When all these settings have been made, click on the OK button
  
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
  
• Next press the Apply button and then the OK to exit the Internet Properties page.
  

Additional Security Measures

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

SpywareBlaster- SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

Cookienator- Scans your PC for tracking cookies in multiple browsers as well as in Adobe Flash.

Winpatrol Download and install the free version of Winpatrol. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.

Secunia software inspector & update checker

My Blog Malware And Spyware Tips

Also, see here for system improvement: Help! My computer is slow!

It was a pleasure working with you.

[bkoopers]

I performed the Java uninstall and then installed JRE 6 Update 20.

I ran the

[Kenny94]

Is there any scan I can run (or have ran already) that I tell Symantec that proves