Accountant's Computer

[AdvancedSetup]

If they were going to get infected they would have gotten infected by now, but since this was already cleaned some by AV or other attempts its difficult to tell what all was there.

Yes you can wait but make sure you enable their normal AV and update it.

[BryanO]

Well,I don't know how long this has been on the systems,so for all I know the other two have been infected already.Malwayre bytes didn't find the same set of results on the other two computers though,if I remember right,so hopefully that's okay.

I've updated their AVG,and told them to regularly change their passwords.So,I'll see what happens on Friday now.

[AdvancedSetup]

Sounds good, let me know.

I'll close your post soon so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?

[BryanO]

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Friday, July 23, 2010

Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Friday, July 23, 2010 05:03:30

Records in database: 4229778

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

A:\

C:\

D:\

Scan statistics:

Objects scanned: 110604

Threats found: 1

Infected objects found: 4

Suspicious objects found: 0

Scan duration: 03:38:40

File name / Threat / Threats count

C:\System Volume Information\_restore{E3999490-0950-4EDB-A452-A06C672D2567}\RP382\A0124699.exe Infected: Packed.Win32.Krap.hc 1

C:\System Volume Information\_restore{E3999490-0950-4EDB-A452-A06C672D2567}\RP382\A0124703.exe Infected: Packed.Win32.Krap.hc 1

C:\System Volume Information\_restore{E3999490-0950-4EDB-A452-A06C672D2567}\RP382\A0124708.exe Infected: Packed.Win32.Krap.hc 1

C:\System Volume Information\_restore{E3999490-0950-4EDB-A452-A06C672D2567}\RP382\A0124712.exe Infected: Packed.Win32.Krap.hc 1

Selected area has been scanned.

[AdvancedSetup]

Great, those are all just in the Restore section of the system. The removal of Combofix will clean that out as well.

We should be done here. Some final housekeeping instructions, and protection information for you.

Your logs appear clean.You should be good to go. We still have a few items to address.

Disable your AntiVirus temporarily so that it does not block removal of Combofix.

Press the Windows key + R -> in the Run box which opens -> copy/paste in the following single line command & click OK

ComboFix /Uninstall

This will uninstall ComboFix. It will also implement some cleanup procedures.

Re-enable your AntiVirus now.

Delete any remaining tools we've used (DDS and GMER) and logs from them.

Empty your Recycle Bin.

============================================

I'll close your post soon so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!