Notebook Infected Too- MBAM couldn't kill it alone

[lostman14]

Now the notebook I use as a spare has a fake anti-virus program going on- rogue antivirus suite. I saw it come up and shut down immediately. It got in though. AVG did nothing. Ran MBAM in safe mode and it found 18 registry keys infected. Ran again after reboot and it found only one and cleaned that too. Still, getting internet freezes and redirects. Tried an online scanner that found about 3 things and cleaned them. Would not run again. Decided to seek counsel. Started at the beginning. Here are the MBAM log, DDS, and attachments. Thank you for your assistance once again!

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4327

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 7.0.6002.18005

7/19/2010 5:09:50 PM

mbam-log-2010-07-19 (17-09-50).txt

Scan type: Quick scan

Objects scanned: 127845

Time elapsed: 6 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-03-17.01) - NTFSx86

Run by Pat at 17:50:28.59 on Mon 07/19/2010

Internet Explorer: 7.0.6002.18005

Microsoft

Attach.zip

ark.zip

[screen317]

Hi again.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.
  

-screen317

[lostman14]

Hi to you too. So glad for your help. This one may be a bit nasty. Here's combofix and new DDS:

ComboFix 10-07-19.02 - Pat 07/20/2010 0:27.1.2 - x86

Microsoft

[screen317]

Hi,

Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.

• Click Start Scanning.
  
• You should get a notification bar (on top) to install the ActiveX control.
  
• Click on it and select to install the ActiveX.
  
• Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
  
• In case you are having problems with installing the ActiveX/starting the scan, please read here.
  
• Click the Full System Scan button.
  
• It will start to download scanner components and databases. This can take a while.
  
• The main scan will start.
  
• Once the scan has finished scanning, click the Automatic cleaning (recommended) button
  
• It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
  
• The cleaning can take a while, so please be patient.
  
• Then click the Show report button and Copy/Paste what is present under results in your next reply.
  

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[lostman14]

The f-secure online scanner took a very long time to finish but did. It initially found 3 things and started cleaning. It got hung up and after about 14 hours or so I restarted the scan. It finished in a pretty short time, found 1 thing and cleaned it. Here is the log followed by your security check report:

Scanning Report

Wednesday, July 21, 2010 09:00:26 - 10:54:08

Computer name: PAT-PC

Scanning type: Scan system for malware, spyware and rootkits

Target: C:\ D:\

--------------------------------------------------------------------------------

1 malware found

Rootkit.Patched.TDSS.Gen (virus)

C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-DYNAMICVOLUMEMANAGER_31BF3856AD364E35_6.0.6002.18005_NONE_DEEE3B0E834AA238\VOLMGRX.SYS (Disinfected & Submitted)

--------------------------------------------------------------------------------

Statistics

Scanned:

Files: 77832

System: 3604

Not scanned: 19

Actions:

Disinfected: 1

Renamed: 0

Deleted: 0

Not cleaned: 0

Submitted: 1

Files not scanned:

C:\PAGEFILE.SYS

C:\WINDOWS\SYSTEM32\CONFIG\SAM

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY

C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB

C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB

C:\USERS\PAT\APPDATA\LOCAL\TEMP\HSPERFDATA_PAT\3904

C:\USERS\PAT\APPDATA\LOCAL\TEMP\HSPERFDATA_PAT\2920

C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\1A5E48635EB7ECDB3DA2FFF5465C347C_F31B7547-F92F-429E-9B55-F17192F11FD8

C:\BOOT\BCD

--------------------------------------------------------------------------------

Options

Scanning engines:

Scanning options:

Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR

Use advanced heuristics

--------------------------------------------------------------------------------

Copyright

[screen317]

Hi,

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

Adobe Reader 8.2.3

Restart your computer.

Get the latest version of Adobe Reader.

Let me know how things are running now.

-screen317

[lostman14]

All done'. Things are looking much better.

[screen317]

Great. Please enable UAC (it's Vista's most important security feature).

Next, click Start, type in Windows Update, and click on Windows Update when it appears.

Download all available updates including Internet Explorer 8.

After that, restart your computer and let me know if the updates went okay.

[lostman14]

OK, annoying UAC is back on. I'll get used to it if you think it's worth it.

Updates went great. IE8 seems very quick. Everything seems quick.

Don you have a recommendation for a replacement for AVG? I'm a little disappointed that all the issues with both machines occurred since I changed over to AVG. I had the mcafee subscription through Comcast. They switched to Norton and that is when I went to AVG. Now I'm wondering if the Norton product may be better. Any recommendations? Thanks for everything so far.

[screen317]

Hi,

Yes UAC is worth it. Keep in mind you came here infected with it off...

Here is my usual antivirus recommendation speech:

It is really dangerous to go online without an antivirus. Without one, you are extremely likely to get infected and the consequences could be even worse next time. All of the following are excellent free antiviruses. Be sure to only install one.

Microsoft Security Essentials

AntiVir

avast!.

[lostman14]

Antivir installed, updated, scan run, clean. Everything is looking very nice.

[screen317]

Great.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Download and install IE-Spyad, which will place over 5000 'bad' sites on your Internet Explorer Restricted List. A tutorial on it can be found here.

3) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

4) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

5) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

6) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[lostman14]

Allright, Chris. I'm all over this stuff. Thank you so much again!

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!