Help - check that computer is clean

[Clare]

Hello,

I need some help please to see if my laptop is clean/secure. I think it is but...

Recently I was infected with a fake anti-virus program, Antivirus Soft I think, the one that stops you using pretty much any other program. I found an article online, ran the computer in safe mode, did the IE's tools>Internet Options>Connections>Lan Settings check and took the tick out of the box and then ran Malwarebytes [full scan]. It found 4 problems and sorted it out for me.

Here's the log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4063

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 8.0.6001.18904

04/05/2010 11:33:43

mbam-log-2010-05-04 (11-33-43).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 259466

Time elapsed: 1 hour(s), 54 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bklmlhap (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Clare\AppData\Local\fpgisduqc\cvkmqostssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Everything seemed to be working fine, I had 2 clean full scans, 1 in safe mode, but then the next scan after that picked up another problem, [NB: Drive F is an external hard drive I use for storage, I inlcuded it in this scan just in case]:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4068

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18904

05/05/2010 13:18:15

mbam-log-2010-05-05 (13-18-15).txt

Scan type: Full scan (C:\|D:\|F:\|)

Objects scanned: 207034

Time elapsed: 2 hour(s), 5 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Clare\AppData\Local\Temp\SBvL.exe (Rogue.AntiSpywareSoft) -> Quarantined and deleted successfully.

Since then I've had several clean scans, but I'm worried that there's still something lurking on the computer as I don't understand why the 2nd infection didn't show up in the first scan as I'm pretty sure it must have happened at the same time as the orginal problem.

I've followed the instructions in the pinned post 'I'm infected - What do I do now?' post and have attached the logs. I'll paste in the 'DDS.txt' at the end. I'm not sure I needed to use Defrogger, it seemed to work but didn't ask me to reboot:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 18:50 on 06/05/2010 (Clare)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

Did I not do it properly?

I'd appreciate the help, I'd really like to be able to use the laptop properly again and have no idea what the logs mean, at the moment I daren't risk logging into Ebay etc. until I talk to someone who knows what they're doing

I have AVG Anti-Virus Free installed as well but it didn't pick up on any of this

Oh, my computer is using Vista Home Premium, Service Pack 2, 32-bit Operating System if that's any use.

Thanks for your time.

Clare

DDS Log:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Clare at 18:55:11.97 on 06/05/2010

Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_18

Microsoft

ark_and_Attach_logs.zip

[Maniac]

Hello Clare! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  

Step 1:

Please, uninstall the following applications:

1. Adobe Reader 8.2.2
   

You can read, how to this in:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 2:

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Windows\Sun
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Step 3:

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

1. JavaRa log
   
2. MalwareBytes' Anti-Malware log
   

[Clare]

Hello Borislav,

Thank you for answering my post

I followed your instructions as best I could.

Step 1:

Adobe Reader 8.2.2 has been uninstalled.

Step 2:

Uninstalled Java in Control Panel > Add/Remove programs.

JavaRa said it would open a log file, but it didn't pop up, so I don't know if there is a log file or where it is, but I did run it.

DELETED - C:\Program Files\Java

DELETED - C:\Program Files\Common Files\Java

DELETED - C:\Windows\Sun

This was a hidden file:

DELETED - C:\Documents and Settings\All Users\Application Data\Sun\Java

I can't find these anywhere:

C:\Documents and Settings\All Users\Application Data\Java

C:\Documents and Settings\username\Application Data\Java

C:\Documents and Settings\username\Application Data\Sun\Java

I ran the Malwarebytes quick scan anyway and the log is at the end of the post.

Thanks again for your help.

Clare

Log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4073

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18904

07/05/2010 00:23:16

mbam-log-2010-05-07 (00-23-16).txt

Scan type: Quick scan

Objects scanned: 118238

Time elapsed: 7 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Maniac]

Very good, Clare!

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[Clare]

Hello again

I found out why the log file for JavaRa didn't pop up, I had to right click the icon and 'run as administrator', there wasn't any lists of java in the log file so it looks like it ran fine before but just didn't produce the log.

Okay, I found this bit scary I turned of my windows firewall, and windows defender before running combofix. I had to uninstall AVG Anti-virus Free as I couldn't get it to shut down completely. I followed the instructions for AVG 9, but Combofix still saw it as active as there's a couple of things you can't disable - can I re-install it now?

Combofix appears to have deleted some files connected to my Acer Crystal webcam, why? I got that with the laptop and have no way to re-install those files if needed. Not that I use the it, but still it's a worry.

Thanks again for the help and here's the log file.

Clare

Log:

ComboFix 10-05-05.0D - Clare 07/05/2010 2:02.1.2 - x86

Microsoft

[Maniac]

Don't worry about the camera, this would not affect. Wait for AVG!

ComboFix log seems to be clean. How are things now?

[Clare]

Seems fine, though I haven't done much, bit of surfing, tried a dvd, played an avi file. What should I be looking out for?

Does that mean it's safe now?

Clare

[Maniac]

Nothing specific, just do it with your computer, you do usually. I'll wait three days to tell me how things go and then do some final steps.

[Clare]

What about virus protection? I'm a bit wary of leaving AVG off even if it didn't catch the problem, I don't have any active protection except for windows defender and the firewall and neither of those were any help.

Clare

[Maniac]

You can download and install the latest version of AVG from:

http://downloadfree.grisoft.com/inst/avg_f...90_819a2842.exe

[Clare]

Your file is different to the one I just got from the website: http://free.avg.com/ww-en/download.prd-afg

Thanks, I'll install it again and come back on the 10th to let you know how things are going

I know I'm being a pest, but should I be doing all of this on my desktop computer as well? Malwarebytes caught a Trojan trying to download a while ago but things seem okay.

Can I re-install the latest versions of Java and Adobe Reader?

Clare

[Maniac]

I are planning this for last but if you want, download and install the latest version of Adobe Reader from here:

www.adobe.com

[Clare]

No, that's fine. I can wait to re-install it

Thanks.

Clare

[Clare]

Crikey, all the way back on the 6th page!

I'm back Borislav!

Everything seems to be working fine.

The only thing I've noticed, which I don't think is related and is just a Vista quirk, is that the recycle bin icon is showing as full when it isn't, but that's happened before so nothing to do with the computer been infected.

What do I do now to be declared free of infestation?

Do I run Malwarebytes to check again? Then can I install Adobe and delete the virus scan tools?

Thanks!

Clare

[Maniac]

Everything seems to be working fine.

Good news!

The only thing I've noticed, which I don't think is related and is just a Vista quirk, is that the recycle bin icon is showing as full when it isn't, but that's happened before so nothing to do with the computer been infected.

The problem is not due to malware. Please see here:

http://www.winhelponline.com/articles/252/...omatically.html

Then can I install Adobe and delete the virus scan tools?

Yes, let's do it.

Step 1:

* Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Step 2:

Please manually delete DDS, GMER and JavaRa.

Step 3:

Please download and install the latest version of Adobe Reader from:

http://www.adobe.com/

About Java:

www.java.com/en

Step 4:

Some malware preventions:

http://miekiemoes.blogspot.com/2008/02/how...nt-malware.html

Safe surfing!

[Clare]

Borislav all done,

Thank you so much for the help! I feel more comfortable about using my laptop normally now, secure sites etc...

Really appreciate it

Take care,

Clare

[Maniac]

You're welcome, Clare!