C:\Windows\System32\autorun.inf

[beversoll]

Does anyone know what this is. MBAM quick scan found it. I was on the internet without malware protection, per directions of ms tech troubleshooting vista 1 issues. They logged in remotely to my pc, so I am not sure if it is related to that are not.

I ran a full scan with MBAM, full and quick scan with Windows Defender, complete scan with Trend Micro, and online scan with F-Secure, and nothing showed up. I ran Hijackthis and compared a clean log to a new one and did not notice any changes (other than ones I was familiar with).

Thanks for your help.

Malwarebytes' Anti-Malware 1.14

Database version: 826

9:38:09 PM 6/4/2008

mbam-log-6-4-2008 (21-38-09).txt

Scan type: Quick Scan

Objects scanned: 33892

Time elapsed: 2 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\System32\autorun.inf (Trojan.FakeAlert) -> Quarantined and deleted successfully.

[GT500]

It's a file that shouldn't be there. MBAM is probably saying it's a trojan simply because of that fact. You can attach the file to a forum post, and Bruce can take a look at it to see what it is.

[nosirrah]

I was asked to add this by someone that had an infection , this was part of it .

It should not be there and is safe to remove .

I removed it from 831 to check it out more but in 832 it will be back .

[beversoll]

I think I did this right. I quarantined it then restored it to upload it. I believe I uploaded the file but not sure if I did it right. Thanks again

.

[beversoll]

833 found it and I deleted it. I can't say thank you enough.

[JeanInMontana]

833 found it and I deleted it. I can't say thank you enough.

Hi beversoll I think you should have a total look at your system http://www.malwarebytes.org/forums/index.php?showtopic=2936 follow the instructions there and start a new topic in that forum. Just to be sure.

[beversoll]

Hi beversoll I think you should have a total look at your system http://www.malwarebytes.org/forums/index.php?showtopic=2936 follow the instructions there and start a new topic in that forum. Just to be sure.

Hi JeanInMontana,

I do have a Hijackthis log posted on the Dell Community Forum http://www.dellcommunity.com/supportforums...thread.id=87437

In the past Bugbatter reviewed one of my logs (I ran a log to see what was in my system, panicked when I saw gopher prefix, then was enligthend this is a normal vista entry). I ran another log after MBAM removed the file and compared the two and they were identical other than entries that I controlled (ie. added SiteAdvisor and removed it so theres an 03 Toolbar with no name and file missing). Not sure if I should post in two places. If you would still like me to proceed with your instructions I will. I do appreciate your help.

Thanks

[JeanInMontana]

Bugbatter is an excellent helper, however she isn't in that link you posted unless I am blind. I don't see that anyone has responded to you. You are right in sticking with one site or another. I guess it boils down to how long you want to wait for help. That post at Dell is 2 days old and we have a whole new version of MBAM out.

[beversoll]

Hi JeanInMontana,

The previous log that was reviewed was about two months, so you are correct, no one has responded to that one. I will follow your directions and post the results in the HJT forum.